Security posture
Small attack surface by design
Novel Phoenix is a static, read-only public site. It has no account system, backend API, database, payment processor, writable admin route, server secret, or browser-side deployment credential.
Controls in place
- HTTPS delivery through Vercel, with GitHub Pages retained as a deployment fallback, and no mixed-content dependencies.
- A default-deny Content Security Policy for scripts, connections, frames, objects, workers, media, and forms.
- No third-party JavaScript, analytics, ads, remote fonts, or embedded content.
- CSV size and row limits, normalized fields, escaped rendered text, and rejection of unsafe URL schemes.
- Outbound links isolate the opener and suppress referrer data.
- Published snapshots remove local filenames and never contain repository credentials.
- Automated tests, production builds, CodeQL scanning, dependency updates, and least-privilege deployment permissions.
Hosting and firewall boundary
Vercel operates the production CDN, TLS termination, automatic DDoS mitigation, and hosting perimeter. The deployment applies the hardened response headers defined in this repository. This project has no application origin server to expose. No custom paid firewall rules or rate limits are represented as active unless they are separately enabled and verified in Vercel.
Report a vulnerability
Use GitHub's private security-advisory form. Include the affected URL or file, impact, reproduction steps, and a safe proof of concept. Do not post an unpatched vulnerability, credentials, cookies, private exports, or personal information in a public issue. Good-faith research that avoids privacy violations, service disruption, and data destruction is welcome.