Security

This page describes how the site is built and secured, and how to report a problem. It covers the website only.

Who we are

Guardian Research LLC ("Guardian", "we", "us") is a limited liability company organised in Utah and based in Lehi, Utah, United States. You can reach us at matthew@guardianresearch.io.

How the site is built

Every page here is a static file. There is no database behind the site, no application server, no login, no form, no file upload, and no client-side JavaScript of any kind. Nothing a visitor does can write to anything. The smallest attack surface available was the design goal, and this is what it looks like.

Transport and browser hardening

The site is served over HTTPS only, with HTTP Strict Transport Security set for two years including subdomains. A Content Security Policy restricts the page to resources from this origin and forbids scripts, framing, and plugin content. The site also sets X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and X-Permitted-Cross-Domain-Policies. Fonts and stylesheets are self-hosted, so no third-party origin is contacted when you load a page.

What is not here

No client information, no research, and no confidential material is stored on this site or on the systems that serve it. Work product is held separately and is shared only with the party it belongs to.

Accounts behind the site

The domain, the code repository, and the hosting account are held in the firm's name, protected by unique credentials in a password manager, and secured with multi-factor authentication where the provider offers it. Changes to the site are published from a version-controlled repository, so every change is attributable and reversible.

Reporting a vulnerability

If you believe you have found a security issue in this site, please write to matthew@guardianresearch.io with enough detail to reproduce it. We will acknowledge you, keep you informed, and fix what needs fixing. Please do not access or modify data that is not yours, degrade the service, or disclose the issue publicly until it is resolved. We do not operate a paid bug bounty, and we will not pursue anyone who reports in good faith under these terms. A machine-readable copy of this contact lives at /.well-known/security.txt.

Changes

This page is reviewed when the site changes. The effective date at the top shows the current version.