Security posture
Security is a continuing practice. This page explains the measures, limits and reporting path for HAPSA’s public website and free toolkit.
How we protect the public site
- HTTPS enforcement, HSTS, framing controls and a Content Security Policy are configured at the hosting layer.
- Toolkit inputs are processed locally unless a tool clearly states that it makes a public DNS or k-anonymous password-exposure request.
- Static-site changes are validated in GitHub Actions before and after merge.
- The optional same-origin DNS relay accepts only passive, allowlisted query types and applies rate limits.
Tool boundaries
The tools provide directional checks, self-assessments and planning drafts. They do not perform port scans, exploit testing, authentication testing, malware execution, legal determinations, compliance certification or incident containment. Results need business context and qualified human review.
Data and privacy
Our Privacy Policy distinguishes local checks from external provider requests. Do not enter production credentials, secrets, regulated data or sensitive personal data into browser tools.
Report a vulnerability
Use the Responsible Disclosure Policy and security.txt. Do not access data, disrupt services, bypass controls or test outside the stated scope.
Continuous improvement
We review controls, dependency updates, tool methodology and disclosure handling as the site evolves. This page avoids claims of certifications, clients, partnerships or results that HAPSA cannot substantiate.