SECURITY
Same-origin, minimal-dependency public web architecture.
The release is designed to minimize supply-chain and privacy exposure: no required third-party runtime libraries, CDN, remote analytics, hosted fonts, social widgets, or external application APIs.
Public web controls
- Content Security Policy limits runtime resources to the same origin.
- No application session is created for public browsing.
- No public contact form or file upload endpoint is included.
- Server-side templates accept no user-supplied HTML.
- Runtime JavaScript is first-party and does not use
evalor remote imports. - Security headers are set in PHP and repeated in the Apache example configuration.
Vulnerability reporting
Send only unclassified vulnerability coordination information to security@weaponizedautonomy.com. Do not include classified or controlled program information in ordinary email.
Security contact file
Machine-readable disclosure information is available at /.well-known/security.txt.