Security
What is actually enforced, and what is not claimed.
Atarla argues that authority over a business's information should be explicit and checkable. That argument is worth nothing if this site will not apply it to itself. Everything in the first table below is live now and can be verified from outside with a single request. Everything in the second is absent, and is listed so that absence is never mistaken for silence.
Enforced today.
- Content Security Policy
- default-src 'self'. No third-party script, style, font, image or connect origin is permitted, so an injected tag has nowhere to send data.
- Transport
- HTTPS only, with HSTS and includeSubDomains. HTTP is upgraded before it leaves the browser.
- Framing
- frame-ancestors 'none'. The site cannot be embedded, so clickjacking has no surface.
- Sniffing
- X-Content-Type-Options: nosniff on every response.
- Referrers
- strict-origin-when-cross-origin, so a full URL is never handed to another site.
- Device access
- Permissions-Policy denies camera, geolocation, payment and USB outright.
- Cookies
- None. The site sets no cookie of any kind, so there is no session to steal and no consent banner to need.
- Form storage
- Submissions go to a private Cloudflare D1 database with no public read endpoint.
- Abuse limits
- Forms and the site guide are rate limited. The visitor IP is put through a one-way hash and only that value is used as the key; the address itself is not stored.
- Site guide output
- The guide answers from fixed rules first. When a model is used, its reply is validated in Atarla's own code before display and is refused outright if it contains a link, a scheme, a bare domain or markup, because a URL in that prose could only be an injected target.
Not claimed.
- No third-party security certification or attestation of any kind exists, under any framework. None is claimed, and no wording on this site should be read as implying one. If you need a named framework for a procurement checklist, the honest answer today is that Atarla has none.
- No third-party penetration test or security audit has been performed.
- There is no production hardware, so no hardware supply chain, secure boot or physical tamper claim is made.
- The deterministic policy layer described in the white paper is a design under test, not a shipped control.
Reporting a vulnerability.
Report anything you find, including issues in this site itself. You will get a human reply. Please give Atarla a reasonable window to fix an issue before publishing it, and do not access, modify or retain anyone else's data while testing.
A machine-readable copy of this contact is published at /.well-known/security.txt.