Security should be visible at the boundary.

Last updated: August 7, 2026

No public system can promise absolute security. These controls reduce exposure, constrain what the site can do, and make the remaining boundaries explicit.

Web and browser boundary

HTTPS is required. The edge applies an enforced Content Security Policy, denies framing, limits browser permissions, blocks mixed content, strips server-identifying headers, rejects non-read-only HTTP methods, and prevents public access to deployment and source paths.

Public tools

There is no public upload endpoint. Deep Constraints Triage runs in the visitor's browser and makes no network request with entered data. Its working draft and local incident log use local browser storage, which is not encrypted by Crusoe Advisory. The tool provides a Clear local data control and limits text and numeric input sizes.

Do not enter passwords, API keys, personal data, health or financial information, regulated records, export-controlled material, or confidential production details. Public research methods are read-only and accept no case data.

Server boundary

The production host limits inbound traffic to required services, filters both IPv4 and IPv6, uses key-only administrative access, automated security updates, and automated blocking for repeated authentication failures. The web container receives a read-only site mount and a reduced runtime privilege set. Operational logs minimize query and network-address detail and rotate on a fixed schedule.

Client and research data

Security controls on this public site do not turn it into a secure intake portal. Non-public material requires an agreed transfer system, access list, retention period, and deletion process before collection. See Data handling.

Responsible disclosure

If you believe you found a vulnerability, email brian@crusoeadvisory.com with the affected URL, observed behavior, reproduction steps, and potential impact. Do not include secrets or client information, access other people's data, degrade availability, or use destructive testing.