Security Information
Bane's Lab is a static informational site. I do not collect, store, or process personal data. This document explains the security measures that protect content delivery and your visit.
Effective: September 22, 2026Updated: September 24, 2026v2.2.1
A1Data Protection Overview
The site does not maintain accounts, login, or persistent user data storage. Your visit involves only the transport of public page content from my server to your browser, protected end-to-end by TLS.
A1.1What I Do Not Collect
- Accounts
- No registration, login, or user accounts of any kind
- Authentication
- No passwords, sessions, or credential storage
- Personal Data
- No names, emails, payment info, or profile data stored server-side
- Tracking
- No analytics scripts, ad networks, or third-party trackers
- Cookies
- No application cookies are set during normal browsing
Without a user data store there is no database for an attacker to compromise. The threat model is intentionally minimal.
A1.2Encryption in Transit
All content is delivered over HTTPS with these transport settings:
- TLS Versions
- TLS 1.2 and TLS 1.3 only (older, vulnerable protocols disabled)
- Perfect Forward Secrecy
- Enabled, so recorded sessions cannot be decrypted with a long-term key exposed later
- HTTP/2
- Enabled
- Certificate Authority
- Let's Encrypt with automatic renewal
- HSTS
- HTTP Strict Transport Security with 1-year duration, includeSubDomains, and preload directives
Cipher Suites
- ECDHE-ECDSA-AES128-GCM-SHA256
- ECDHE-RSA-AES128-GCM-SHA256
- ECDHE-ECDSA-AES256-GCM-SHA384
- ECDHE-RSA-AES256-GCM-SHA384
- ECDHE-ECDSA-CHACHA20-POLY1305
- ECDHE-RSA-CHACHA20-POLY1305
B1Application Security
B1.1Security Headers
Every page carries these security headers. Assets, JSON payloads and Markdown alternates carry Strict-Transport-Security, X-Content-Type-Options and Cross-Origin-Resource-Policy.
| Header | Value | Purpose |
|---|---|---|
Content-Security-Policy | default-src 'none' | nothing loads unless a directive allows it; scripts and stylesheets run only with the nonce issued for that response, and 'strict-dynamic' trusts what a nonced script loads; fonts only from this origin; no framing, no plugins |
X-Content-Type-Options | nosniff | prevents MIME type sniffing |
X-Frame-Options | DENY | fallback for browsers without CSP frame-ancestors, which refuses all framing |
X-XSS-Protection | 0 | disabled in favor of CSP |
Referrer-Policy | same-origin | sends the referrer to this origin only |
Permissions-Policy | all denied | accelerometer, camera, geolocation, gyroscope, magnetometer, microphone, payment, USB and interest cohorts disabled |
Strict-Transport-Security | max-age=31536000 | includeSubDomains; preload |
Cross-Origin-Opener-Policy | same-origin | isolates the browsing context from cross-origin windows |
Cross-Origin-Embedder-Policy | credentialless | cross-origin resources load without credentials |
Cross-Origin-Resource-Policy | same-origin | pages and assets are not embeddable elsewhere; the JSON payloads and Markdown alternates are the cross-origin surfaces |
tdm-reservation | 0 | text-and-data-mining rights are not reserved; crawling, indexing and model training are consented to |
C1Infrastructure
C1.1Architecture
- Edge
- NGINX terminates TLS and serves files straight from disk
- No Backend
- There is no application server, database, or runtime process behind the edge; every page is pre-rendered at build time
- Header Stripping
- The Server header and every version identifier are removed from responses
- Static Delivery
- Pre-rendered HTML pages plus content-hashed CSS/JS served with long-term caching
- Machine-Readable Content
- Each page and tab is also published as a JSON payload under /json/ and as a Markdown alternate at its own path with a .md suffix (or by requesting the page with an Accept header of text/markdown), readable from any origin; both carry only the same public content as the page
- Published Source
- The Anatomy page publishes the source of every workspace member of the site, with one page per folder and file. Each file's text is served as a static file under /static/source/generated/ and its syntax walk under /static/walk/generated/, derived from the same build that produced the page
C1.2Network
- Firewall
- Host-based firewall restricts access to essential ports
- Port Exposure
- Only HTTPS (443) and HTTP (80, redirect only) exposed
- Canonical Host
- Plain HTTP and the www subdomain permanently redirect to https://banes-lab.com
- Mail Transport
- Mail for this domain is handled by its registrar's forwarding servers; a published MTA-STS policy in enforce mode requires sending servers to deliver over TLS with a matching certificate, and a TLS reporting record asks them to report any failure to do so
D1Third-Party Services
D1.1What Loads From Outside My Server
- Certificate Authority
- Let's Encrypt for TLS certificates
Every script, stylesheet, font and image is served from this origin. No content delivery network, analytics, advertising, or user-tracking third parties are loaded.
E1Contact
E1.1Security Reports
- jay@banes-lab.com
- Note
- Responses are best-effort and not guaranteed within a fixed window.
Responsible disclosure is appreciated.
E1.2Document Updates
This document is updated when my security practices change.
F1Technical Details
F1.1TLS Configuration
- SSL Session Cache
- Shared, ten megabytes
- SSL Session Timeout
- 10 minutes
- SSL Session Tickets
- Disabled (keeps forward secrecy intact; resumption uses the server-side session cache instead)
- Certificate Chain
- Full chain with intermediate certificates