{
  "content": {
    "kind": "document",
    "meta": {
      "closing": "Last Technical Review: September 24, 2026",
      "effectiveDate": "September 22, 2026",
      "intro": "Bane's Lab is a static informational site. I do not collect, store, or process personal data. This document explains the security measures that protect content delivery and your visit.",
      "lastUpdated": "September 24, 2026",
      "title": "Security Information",
      "version": "2.2.1"
    },
    "sections": [
      {
        "icon": "bi-shield-lock",
        "id": "data-protection",
        "intro": "The site does not maintain accounts, login, or persistent user data storage. Your visit involves only the transport of public page content from my server to your browser, protected end-to-end by TLS.",
        "subsections": [
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "No registration, login, or user accounts of any kind",
                    "term": "Accounts"
                  },
                  {
                    "description": "No passwords, sessions, or credential storage",
                    "term": "Authentication"
                  },
                  {
                    "description": "No names, emails, payment info, or profile data stored server-side",
                    "term": "Personal Data"
                  },
                  {
                    "description": "No analytics scripts, ad networks, or third-party trackers",
                    "term": "Tracking"
                  },
                  {
                    "description": "No application cookies are set during normal browsing",
                    "term": "Cookies"
                  }
                ],
                "kind": "glossary"
              },
              {
                "kind": "text",
                "note": true,
                "text": "Without a user data store there is no database for an attacker to compromise. The threat model is intentionally minimal."
              }
            ],
            "title": "What I Do Not Collect"
          },
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "TLS 1.2 and TLS 1.3 only (older, vulnerable protocols disabled)",
                    "term": "TLS Versions"
                  },
                  {
                    "description": "Enabled, so recorded sessions cannot be decrypted with a long-term key exposed later",
                    "term": "Perfect Forward Secrecy"
                  },
                  {
                    "description": "Enabled",
                    "term": "HTTP/2"
                  },
                  {
                    "description": "Let's Encrypt with automatic renewal",
                    "term": "Certificate Authority"
                  },
                  {
                    "description": "HTTP Strict Transport Security with 1-year duration, includeSubDomains, and preload directives",
                    "term": "HSTS"
                  }
                ],
                "kind": "glossary"
              },
              {
                "items": [
                  "ECDHE-ECDSA-AES128-GCM-SHA256",
                  "ECDHE-RSA-AES128-GCM-SHA256",
                  "ECDHE-ECDSA-AES256-GCM-SHA384",
                  "ECDHE-RSA-AES256-GCM-SHA384",
                  "ECDHE-ECDSA-CHACHA20-POLY1305",
                  "ECDHE-RSA-CHACHA20-POLY1305"
                ],
                "kind": "list",
                "label": "Cipher Suites"
              }
            ],
            "content": "All content is delivered over HTTPS with these transport settings:",
            "title": "Encryption in Transit"
          }
        ],
        "title": "Data Protection Overview"
      },
      {
        "icon": "bi-code-slash",
        "id": "application-security",
        "subsections": [
          {
            "blocks": [
              {
                "headers": [
                  "Header",
                  "Value",
                  "Purpose"
                ],
                "kind": "table",
                "rows": [
                  [
                    "`Content-Security-Policy`",
                    "default-src 'none'",
                    "nothing loads unless a directive allows it; scripts and stylesheets run only with the nonce issued for that response, and 'strict-dynamic' trusts what a nonced script loads; fonts only from this origin; no framing, no plugins"
                  ],
                  [
                    "`X-Content-Type-Options`",
                    "nosniff",
                    "prevents MIME type sniffing"
                  ],
                  [
                    "`X-Frame-Options`",
                    "DENY",
                    "fallback for browsers without CSP frame-ancestors, which refuses all framing"
                  ],
                  [
                    "`X-XSS-Protection`",
                    "0",
                    "disabled in favor of CSP"
                  ],
                  [
                    "`Referrer-Policy`",
                    "same-origin",
                    "sends the referrer to this origin only"
                  ],
                  [
                    "`Permissions-Policy`",
                    "all denied",
                    "accelerometer, camera, geolocation, gyroscope, magnetometer, microphone, payment, USB and interest cohorts disabled"
                  ],
                  [
                    "`Strict-Transport-Security`",
                    "max-age=31536000",
                    "includeSubDomains; preload"
                  ],
                  [
                    "`Cross-Origin-Opener-Policy`",
                    "same-origin",
                    "isolates the browsing context from cross-origin windows"
                  ],
                  [
                    "`Cross-Origin-Embedder-Policy`",
                    "credentialless",
                    "cross-origin resources load without credentials"
                  ],
                  [
                    "`Cross-Origin-Resource-Policy`",
                    "same-origin",
                    "pages and assets are not embeddable elsewhere; the JSON payloads and Markdown alternates are the cross-origin surfaces"
                  ],
                  [
                    "`tdm-reservation`",
                    "0",
                    "text-and-data-mining rights are not reserved; crawling, indexing and model training are consented to"
                  ]
                ]
              }
            ],
            "content": "Every page carries these security headers. Assets, JSON payloads and Markdown alternates carry Strict-Transport-Security, X-Content-Type-Options and Cross-Origin-Resource-Policy.",
            "title": "Security Headers"
          }
        ],
        "title": "Application Security"
      },
      {
        "icon": "bi-hdd-network",
        "id": "infrastructure",
        "subsections": [
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "NGINX terminates TLS and serves files straight from disk",
                    "term": "Edge"
                  },
                  {
                    "description": "There is no application server, database, or runtime process behind the edge; every page is pre-rendered at build time",
                    "term": "No Backend"
                  },
                  {
                    "description": "The Server header and every version identifier are removed from responses",
                    "term": "Header Stripping"
                  },
                  {
                    "description": "Pre-rendered HTML pages plus content-hashed CSS/JS served with long-term caching",
                    "term": "Static Delivery"
                  },
                  {
                    "description": "Each page and tab is also published as a JSON payload under /json/ and as a Markdown alternate at its own path with a .md suffix (or by requesting the page with an Accept header of text/markdown), readable from any origin; both carry only the same public content as the page",
                    "term": "Machine-Readable Content"
                  },
                  {
                    "description": "The Anatomy page publishes the source of every workspace member of the site, with one page per folder and file. Each file's text is served as a static file under /static/source/generated/ and its syntax walk under /static/walk/generated/, derived from the same build that produced the page",
                    "term": "Published Source"
                  }
                ],
                "kind": "glossary"
              }
            ],
            "title": "Architecture"
          },
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "Host-based firewall restricts access to essential ports",
                    "term": "Firewall"
                  },
                  {
                    "description": "Only HTTPS (443) and HTTP (80, redirect only) exposed",
                    "term": "Port Exposure"
                  },
                  {
                    "description": "Plain HTTP and the www subdomain permanently redirect to https://banes-lab.com",
                    "term": "Canonical Host"
                  },
                  {
                    "description": "Mail for this domain is handled by its registrar's forwarding servers; a published MTA-STS policy in enforce mode requires sending servers to deliver over TLS with a matching certificate, and a TLS reporting record asks them to report any failure to do so",
                    "term": "Mail Transport"
                  }
                ],
                "kind": "glossary"
              }
            ],
            "title": "Network"
          }
        ],
        "title": "Infrastructure"
      },
      {
        "icon": "bi-diagram-3",
        "id": "third-party",
        "subsections": [
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "Let's Encrypt for TLS certificates",
                    "term": "Certificate Authority"
                  }
                ],
                "kind": "glossary"
              },
              {
                "kind": "text",
                "note": true,
                "text": "Every script, stylesheet, font and image is served from this origin. No content delivery network, analytics, advertising, or user-tracking third parties are loaded."
              }
            ],
            "title": "What Loads From Outside My Server"
          }
        ],
        "title": "Third-Party Services"
      },
      {
        "icon": "bi-envelope",
        "id": "contact",
        "subsections": [
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "jay@banes-lab.com",
                    "term": "Email"
                  },
                  {
                    "description": "Responses are best-effort and not guaranteed within a fixed window.",
                    "term": "Note"
                  }
                ],
                "kind": "glossary"
              },
              {
                "kind": "text",
                "note": true,
                "text": "Responsible disclosure is appreciated."
              }
            ],
            "title": "Security Reports"
          },
          {
            "content": "This document is updated when my security practices change.",
            "title": "Document Updates"
          }
        ],
        "title": "Contact"
      },
      {
        "icon": "bi-gear",
        "id": "technical-details",
        "subsections": [
          {
            "blocks": [
              {
                "entries": [
                  {
                    "description": "Shared, ten megabytes",
                    "term": "SSL Session Cache"
                  },
                  {
                    "description": "10 minutes",
                    "term": "SSL Session Timeout"
                  },
                  {
                    "description": "Disabled (keeps forward secrecy intact; resumption uses the server-side session cache instead)",
                    "term": "SSL Session Tickets"
                  },
                  {
                    "description": "Full chain with intermediate certificates",
                    "term": "Certificate Chain"
                  }
                ],
                "kind": "glossary"
              }
            ],
            "title": "TLS Configuration"
          }
        ],
        "title": "Technical Details"
      }
    ]
  },
  "description": "Security information for Bane's Lab: how the static site is delivered, which protections are in place, and what your visit does and does not exchange with the server.",
  "id": "info",
  "label": "Info",
  "tab": null,
  "title": "Info — Bane's Lab",
  "url": "https://banes-lab.com/info"
}