Security policy
The best security measure available to a site like this one is to hold almost nothing. There are no user accounts, no customer portal, no card data and no analytics database. What exists is a list of email addresses, and the web server is configured to refuse every request for the directory holding it.
Reporting a vulnerability
Email contact@compliantbook.com with the subject line starting SECURITY. Include what you found, where, and how to reproduce it. We aim to acknowledge within one working day and to fix confirmed issues quickly.
We will not pursue legal action against anyone who reports a vulnerability in good faith, acts proportionately, does not access or modify data belonging to others, does not degrade the service, and gives us reasonable time to fix the issue before disclosing it. We do not currently run a paid bug bounty, but we will credit you publicly if you would like that.
A security.txt file is published at
/.well-known/security.txt.
What we do
- HTTPS everywhere, with HTTP Strict Transport Security and a long max-age.
- A strict Content Security Policy restricting where scripts, styles, fonts, images and form targets may come from.
- Security headers: X-Content-Type-Options, Referrer-Policy, Permissions-Policy, X-Frame-Options and Cross-Origin-Opener-Policy.
- A static site with no third-party code. The pages you read are files. No content management system, no plugin ecosystem, no database behind them, and nothing loaded from anyone else's server — which removes the overwhelming majority of the attack surface a typical site has, and every supply-chain risk that comes with a CDN.
- The mailing list database is not reachable over the internet at any URL. It sits in a directory the web server is configured to refuse, behind two independent rules, under a filename derived cryptographically from a server-side secret. An automated check runs against the live site and alerts us if either rule is ever lost.
- Administrative access uses a password hashed with Argon2id, a constant-time comparison, rate limiting with lockout, session cookies marked HttpOnly, Secure and SameSite=Strict, and CSRF tokens on every state-changing request.
- Form abuse controls: a honeypot field, a submission-timing check, per-address and per-IP rate limiting, and double opt-in so a submitted address cannot be added without the owner clicking a link.
- Minimal retention. Server logs are deleted within 14 days. Unconfirmed subscriptions are deleted after seven days.
- No card data. Payments are processed by our reseller as merchant of record. We never see, transmit or store card numbers.
What an attacker would find
We think it is more honest to say this plainly than to imply there is a fortress here. A successful compromise of this site would expose a list of email addresses and their confirmation timestamps. It would not expose payment details, passwords belonging to customers, documents, or any special category of personal data, because none of those exist here. If such a breach happened we would notify the supervisory authority within 72 hours and email everyone affected. Privacy policy →
Out of scope
Reports generated purely by automated scanners with no demonstrated impact; missing headers with no exploitable consequence; issues in third-party services we do not control; social engineering of us or our providers; and denial of service. Please do not test payment flows against live checkout — tell us what you suspect instead.
Questions about this page: contact@compliantbook.com