Security

Application controls

• Server-side input validation, bounded request sizes, and an anti-automation trap.
• Per-connection rate limiting for enquiry submission.
• Content Security Policy, anti-framing, MIME-sniffing protection, restricted browser permissions, and strict referrer handling.
• Enquiry records stored in a private Cloudflare D1 database, or with restricted file permissions in a non-public data path for standalone Node.js hosting.
• No client-side secrets and no public endpoint for reading submitted enquiries.

Deployment requirements

The application must be deployed behind HTTPS with controlled administrator access, backups aligned to the retention policy, monitoring, and timely security updates. Cloudflare hosting requires a private D1 binding and applied database migrations; standalone hosting requires a supported Node.js runtime and a protected persistent storage volume. If a workflow webhook is configured, it must use an approved HTTPS endpoint with equivalent data protection.

Health and resilience

The website exposes a read-only health endpoint that verifies access to the enquiry table on Cloudflare, or write access to the protected enquiry directory on standalone Node.js. The public page checks this endpoint periodically and reports the current connection state without exposing enquiry information.

Report a security concern

Use the enquiry form and select “Something else.” Do not include exploit code, credentials, sensitive records, or personal data in the message.