SECURITY.md — adscalculator.xyz

Security baseline & audit log. SEC (security profile) MUST read this before any audit — it is the record of what's done, when, and what remains open. Update in the SAME commit as any security change. Last full audit: Aug 25, 2026.

Current Baseline (verified Aug 25, 2026)

Dependencies

• npm audit: 0 vulnerabilities (was 18 — fixed Aug 25: eleventy 3.1.6, eleventy-img 7 ESM migration with shortcode wrapper)
• .npmrc: puppeteer_skip_download=true (penthouse→critical pulls puppeteer but doesn't use it in build; download 403s otherwise)

HTTP Headers (_headers, Cloudflare Pages)

• X-Content-Type-Options: nosniff ✓
• Referrer-Policy: strict-origin-when-cross-origin ✓
• X-Frame-Options: DENY ✓
• Permissions-Policy: geolocation=(), microphone=(), camera=(), payment=() ✓
• CSP Report-Only (see _headers for directives) — review violations 1–2 weeks from Aug 25, then convert to enforced CSP
• HSTS max-age=15552000 (6mo), includeSubDomains, no-preload — extend to 2y+preload after clean period
• Caching: fonts immutable 1y; assets/images 30d; style.css + js/* revalidate daily

Build & Deploy

• Node 22 pinned: CI uses CF Pages NODE_VERSION env var (CF ignores .nvmrc) + .nvmrc in repo
• Sourcemaps disabled in production build
• wiki/ and AGENTS.md excluded from dist via .eleventyignore (note: eleventyExcludeFromCollections frontmatter does NOT prevent rendering)

Client-side

• GTM consent-gated via cookie + cookieConsentAccepted event (fix e17fa55, Aug 25); noscript pixel removed
• No user accounts, no server-side PII, no stored secrets — client-side calculators only

Open Items

Audit Log

Rules for Next Audit

1. Re-verify every item in Baseline (don't trust this file blindly — check live headers)
2. New findings: fix or add to Open Items with trigger condition
3. Append to Audit Log in the same commit as changes