# Security

stefanwaldvogel.com is a static site: every page runs in your browser, nothing is sent to a server, and there are no accounts.
Data you enter in the apps (Lesson Ledger, Korean Metro, Armour Proving Ground, the Cyber Hunting Guide, Castellan, Pré Carré)
stays in your browser's storage until you export it.

## Reporting a problem

If you find a security problem — for example script injection through an imported file, a share link or stored data — please
tell me privately first:

- LinkedIn message: <https://www.linkedin.com/in/stefan-wa/>

Please include the page, the steps or a sample file, and what happens. I'll reply as soon as I can and credit you if you like.
There is no bug bounty. Please don't run automated scanners against the site or try denial-of-service.

## What the site does to protect you

- A strict Content-Security-Policy for each page: scripts only from this site and from that page's own inline blocks with known
  SHA-256 hashes; no inline event handlers, no plugins, no frames, no outside requests, no framing by other sites.
- Plain HTTP is redirected to HTTPS.
- Exports that other programs open (CSV, Markdown) are made inert: formula-looking CSV cells start with ', Markdown carries no
  HTML and no script links.
- Imported files, share links and saved data are checked (types, sizes, known keys) before use, and text is escaped when shown.
- Outside links open with `rel="noopener noreferrer"`.

Machine-readable contact details: [/.well-known/security.txt](.well-known/security.txt).