Security
Valestiom is a static site with no application server, no upload endpoint, and no database, which removes most of the surface an attacker would normally aim at.
Last reviewed:
Browser-only processing
Selected files are read with browser APIs and transformed locally. No upload endpoint, backend server, or database is required for the included tools, so there is no stored copy of your work to be exposed if this site were ever compromised.
Response headers
Every page is served with a restrictive Content Security Policy, clickjacking and MIME-sniffing protections, a strict referrer policy, and a permissions policy that denies camera, microphone, geolocation, payment, and USB access. The camera is enabled on one route only, the QR code scanner, and only after your browser asks you to allow it.
How the site is kept safe
- Pages are served only over HTTPS, with a strict transport policy asking browsers to refuse an unencrypted connection.
- Open-source libraries are pinned in the repository and reviewed when they are updated.
- A tool is not shipped if it needs an upload endpoint to work.
- No secrets sit in the pages or scripts, because there is no server-side account for them to unlock.
- The Content Security Policy is reviewed whenever a script or integration is added.
Responsible disclosure
To report a security issue, email Valestiom@gmail.com. Do not attach sensitive user files.
For general, non-sensitive questions you can also use Telegram at @Valestiom.