# CalibreAI Website Security Baseline

This static website is hardened against common browser and web-application risks using the OWASP Top 10:2025 and OWASP Secure Headers guidance as a baseline.

## Controls

- HTTPS enforcement and HSTS at the web-server/edge layer.
- Content Security Policy (CSP) restricting scripts, frames, styles, connections, and object loading.
- `X-Content-Type-Options: nosniff`.
- `X-Frame-Options: DENY` plus CSP `frame-ancestors 'none'`.
- `Referrer-Policy: strict-origin-when-cross-origin`.
- `Permissions-Policy` disabling unused browser capabilities.
- Cross-Origin Opener/Resource Policy headers.
- `X-Permitted-Cross-Domain-Policies: none`.
- Form length limits and safe encoding for the mailto assessment workflow.
- External links use `noopener noreferrer` where applicable.
- Calendly and Google Analytics are explicitly allow-listed in CSP.

## Important limitation

This is a static marketing site. Server-side risks such as authentication, authorization, API access control, database security, server-side request forgery, secret management, and backend logging require controls in the hosting platform and any future SaoR backend.

OWASP Top 10 is an awareness baseline, not a complete verification standard. For comprehensive application verification, use OWASP ASVS and appropriate testing. Do not claim full OWASP Top 10 coverage solely from these controls.

## Reporting

Please report suspected security issues to `office@calibreai.africa`.