Skip to content

Repository navigation

Security: samran2/corporate-security-matrix

Security

Report a vulnerability

SECURITY.md

Security Policy

This repository is a static knowledge project with a deliberately small browser attack surface.

Current hardening

The published site is intended to stay secure by default:

  • no third-party JavaScript
  • search input is filtered in memory, reflected in the page URL and rendered with textContent; it is never submitted, written to cookies or saved through Web Storage (the URL may remain in browser history or a copied link)
  • no innerHTML, eval, string timers or browser storage
  • no external font or asset dependency required for rendering
  • Content Security Policy delivered via HTML meta tag for static hosting compatibility
  • external links opened with noopener noreferrer
  • repository validation script at scripts/validate_project.py
  • GitHub Actions validation workflow at .github/workflows/validate.yml

Runtime checks still required

Some browser protections are stronger as HTTP response headers than as HTML meta tags. If this project is later fronted by a CDN, reverse proxy or custom host, verify:

  • Content-Security-Policy as a response header
  • frame-ancestors or X-Frame-Options for clickjacking defense
  • X-Content-Type-Options: nosniff
  • a deployment-appropriate Referrer-Policy
  • TLS and certificate handling at the hosting layer

On GitHub Pages specifically, treat frame-ancestors, sandbox, reporting directives and some other browser protections as deployment-layer limitations rather than repository-level guarantees.

Report here

Use GitHub issues or pull requests for:

  • broken or outdated official source links
  • incorrect control guidance
  • misleading threat descriptions
  • factual errors in domain mapping
  • validation failures from scripts/validate_project.py or the GitHub Actions workflow

Do not use this project as

  • a substitute for legal advice
  • a substitute for certified life-safety engineering
  • a substitute for country-specific compliance review
  • an emergency response manual

Handling sensitive reports

If you believe a public discussion would create avoidable risk for a real organization, report the issue privately to the maintainer instead of posting operationally sensitive detail.

Use GitHub's private vulnerability reporting page: https://github.com/samran2/corporate-security-matrix/security/advisories/new.

There aren't any published security advisories