Security
How we protect this site
A security firm should lead by example. Here is what we do, what this site collects, and how to report a flaw.
A deliberately simple site
The site is static: no database, no accounts, no content management system to patch. It is served over HTTPS only and sets no cookies. What you do not deploy cannot be attacked.
Few third parties, all listed
| Service | Role | When |
|---|---|---|
| GitHub Pages | Site hosting | All pages |
| Cloudflare Web Analytics | Aggregate analytics, no cookies | All pages |
| Formspree | Contact form delivery | Only when the form is submitted |
| Calendly | Appointment booking | Only if you click “Book” |
| Namecheap | Domain name and email | Outside the site |
Details in our privacy policy.
Technical measures
- A Content Security Policy (CSP) restricts the origins of scripts, connections and resources, and forbids scripts embedded in pages.
- The typeface is hosted on the site itself: no request to a third-party font service.
- DNS Security Extensions (DNSSEC) are enabled on the domain.
- The site publishes a security.txt file (RFC 9116) so researchers know whom to contact.
- Search runs entirely in your browser against a static index: your queries are not transmitted.
Report a vulnerability
If you believe you found a flaw, email contact@fzconsultation.xyz describing what you saw and how to reproduce it. We acknowledge reports within five business days and keep you informed about the fix. We regard good-faith research that follows the rules below as authorized and will not take legal action against you.
Rules for research
- Stay within this site (fzconsultation.xyz). The third-party services listed above have their own programs.
- Do not access, change or keep other people's data. Stop as soon as you have demonstrated the issue.
- No denial of service, phishing or social engineering against our staff or clients.
- Give us reasonable time to fix before any public disclosure.
Out of scope
Automated reports with no demonstrated impact, HTTP headers our host does not let us configure, and findings on third-party services.