Security posture
Small attack surface by design
Novel Phoenix is a static, read-only public site. It has no account system, backend API, database, payment processor, writable admin route, server secret, or browser-side deployment credential.
Controls in place
- HTTPS delivery through GitHub Pages and no mixed-content dependencies.
- A default-deny Content Security Policy for scripts, connections, frames, objects, workers, media, and forms.
- No third-party JavaScript, analytics, ads, remote fonts, or embedded content.
- CSV size and row limits, normalized fields, escaped rendered text, and rejection of unsafe URL schemes.
- Outbound links isolate the opener and suppress referrer data.
- Published snapshots remove local filenames and never contain repository credentials.
- Automated tests, production builds, CodeQL scanning, dependency updates, and least-privilege deployment permissions.
Hosting and firewall boundary
GitHub operates the Pages hosting network, TLS termination, abuse controls, and infrastructure perimeter. This project has no origin server to expose. GitHub Pages does not let this repository configure a custom web application firewall or arbitrary HTTP response headers. A custom-domain WAF can be added later through a reverse proxy such as Cloudflare, but it is not represented as active today.
Report a vulnerability
Use GitHub's private security-advisory form. Include the affected URL or file, impact, reproduction steps, and a safe proof of concept. Do not post an unpatched vulnerability, credentials, cookies, private exports, or personal information in a public issue. Good-faith research that avoids privacy violations, service disruption, and data destruction is welcome.