A static site holds no secrets
The published site is files. It has no server to compromise and no credentials in it, because anything needing a secret is handled by one shared service that the site calls rather than by the site itself.
Security
How it is protected
A published Q-Code site is static files holding no credentials, and everything that can change it proves who is asking before it acts.
What follows is decisions and the reasons for them, rather than a wall of reassuring nouns. The limits are at the bottom, because a security page that only lists strengths is not a security page.
And why
The decisions
Two doors, two strengths
Editing content is behind a sign-in link to your email address, which is a fair lock on a page that edits testimonials. Anything that can rewrite and redeploy the site sits behind a stronger identity check, because the blast radius stops being wrong words on a page.
Ownership is proved, never assumed
Which site a request may touch is taken from the verified grant, never from the request itself. There is no field a caller can set to claim a different project, because the project is not something the request gets to name.
The database decides, not the query
Every site's rows are separated by row-level security rather than by trusting the code to filter correctly. An owner of one site cannot read another's enquiries even if a query asks to, and that was tested rather than assumed.
Spam traps answer politely
A form submission caught by a trap is told it succeeded and is stored nowhere. Telling a bot which attempt failed teaches it how to stop failing.
DNS changes are additive and checked
Attaching a domain only ever creates records. The zone is photographed before any write and compared field by field afterwards, and if one pre-existing record changed the whole operation stops. Mail records are never touched.
Limits
What this does not claim
Stated here so they are found on purpose rather than by accident.
- Preview URLs are unlisted, not private
- A preview build lives on an unguessable address and is marked noindex, but anyone holding the link can open it. Treat it as unlisted rather than secret.
- The audit reads HTML, not a browser
- It catches the causes of layout breakage rather than measuring every symptom at every width, and the report says so rather than implying more confidence than it has.
- One account, one owner
- This platform is built for a single owner. The controls that exist are there to stop a runaway, not to ration a customer, and they would be the wrong shape for a multi-tenant product.
Found something
If you think something here is wrong, say so. How data is handled is covered in the privacy notice.