# Application Security

Page: Info
Canonical: https://banes-lab.com/info#application-security

### Security Headers

Every page carries these security headers. Assets, JSON payloads and Markdown twins carry Strict-Transport-Security, X-Content-Type-Options and Cross-Origin-Resource-Policy.

| Header | Value | Purpose |
|---|---|---|
| Content-Security-Policy | default-src 'none' | nothing loads unless a directive allows it; scripts and stylesheets run only with the nonce issued for that response, and 'strict-dynamic' trusts what a nonced script loads; fonts only from this origin; no framing, no plugins |
| X-Content-Type-Options | nosniff | prevents MIME type sniffing |
| X-Frame-Options | SAMEORIGIN | fallback for browsers without CSP frame-ancestors, which refuses all framing |
| X-XSS-Protection | 0 | disabled in favor of CSP |
| Referrer-Policy | strict-origin-when-cross-origin | limits referrer information |
| Permissions-Policy | all denied | accelerometer, camera, geolocation, gyroscope, magnetometer, microphone, payment, USB and interest cohorts disabled |
| Strict-Transport-Security | max-age=31536000 | includeSubDomains; preload |
| Cross-Origin-Opener-Policy | same-origin | isolates the browsing context from cross-origin windows |
| Cross-Origin-Embedder-Policy | credentialless | cross-origin resources load without credentials |
| Cross-Origin-Resource-Policy | same-origin | pages and assets are not embeddable elsewhere; the JSON payloads and Markdown twins are the cross-origin surfaces |
| tdm-reservation | 0 | text-and-data-mining rights are not reserved; crawling, indexing and model training are consented to |