Security Information
Bane's Lab is a static informational site. We do not collect, store, or process personal user data. This document explains the security measures that protect content delivery and your visit.
Data Protection Overview
The site does not maintain accounts, login, or persistent user data storage. Your visit involves only the transport of public page content from our server to your browser, protected end-to-end by TLS.
What We Do Not Collect
- Accounts
- No registration, login, or user accounts of any kind
- Authentication
- No passwords, sessions, or credential storage
- Personal Data
- No names, emails, payment info, or profile data stored server-side
- Tracking
- No analytics scripts, ad networks, or third-party trackers
- Cookies
- No application cookies are set during normal browsing
Without a user data store there is no database for an attacker to compromise. The threat model is intentionally minimal.
Encryption in Transit
All content is delivered over HTTPS with strong transport security:
- TLS Versions
- TLS 1.2 and TLS 1.3 only (older, vulnerable protocols disabled)
- Perfect Forward Secrecy
- Enabled to ensure session keys cannot be compromised even if long-term keys are exposed
- HTTP/2
- Enabled for improved performance and security
- Certificate Authority
- Let's Encrypt with automatic renewal
- OCSP Stapling
- Enabled for certificate validation
- HSTS
- HTTP Strict Transport Security with 1-year duration, includeSubDomains, and preload directives
Cipher Suites
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-ECDSA-CHACHA20-POLY1305
- ECDHE-RSA-CHACHA20-POLY1305
All HTTP traffic is automatically redirected to HTTPS. There is no way to access the platform over unencrypted connections.
Application Security
Security Headers
All responses include strict security headers:
| Header | Value | Purpose |
|---|---|---|
X-Content-Type-Options | nosniff | prevents MIME type sniffing |
X-Frame-Options | SAMEORIGIN | allows framing only from same origin |
X-XSS-Protection | 0 | disabled in favor of CSP |
Referrer-Policy | strict-origin-when-cross-origin | limits referrer information |
Permissions-Policy | restricted | geolocation, microphone, camera disabled |
Strict-Transport-Security | max-age=31536000 | includeSubDomains; preload |
Infrastructure
Architecture
- Edge
- NGINX reverse proxy terminates TLS and serves static files
- Backend Isolation
- Application backend not directly exposed to the internet
- Header Stripping
- Backend server identifiers removed from responses
- Static Delivery
- Pre-built static HTML/CSS/JS served with long-term caching and integrity checks
Network
- Firewall
- Host-based firewall restricts access to essential ports
- Port Exposure
- Only HTTPS (443) and HTTP (80, redirect only) exposed
- Internal Communication
- Backend services communicate over localhost
Third-Party Services
What Loads From Outside Our Servers
- Bootstrap Icons
- Icon font loaded from jsDelivr CDN
- Certificate Authority
- Let's Encrypt for TLS certificates
No analytics, advertising, or user-tracking third parties are loaded.
Contact
Security Reports
If you discover a security vulnerability or have security concerns:
- contact@banes-lab.com
- Response Time
- Security reports acknowledged within 48 hours
- Note
- security reports prioritized
Responsible disclosure is appreciated.
Document Updates
This document is updated when our security practices change. Last updated June 17, 2026.
Technical Details
TLS Configuration
- SSL Session Cache
- 10MB shared cache
- SSL Session Timeout
- 10 minutes
- SSL Session Tickets
- Disabled (prevents tracking, ensures forward secrecy)
- Certificate Chain
- Full chain with intermediate certificates
- OCSP Resolver
- Cloudflare DNS (1.1.1.1, 1.0.0.1)