Hardening, isolation, integrity and verified recovery: the controls that protect the platform, the appliance and this website.
| Control | Scope | Status | Detail |
|---|---|---|---|
| HTTPS with HSTS | This website | Available in current prototype | TLS on every page; Strict-Transport-Security sent by the server. |
| No cookies, no third-party scripts | This website | Available in current prototype | Fonts, images and scripts are served from this domain only. No trackers, no tag managers. |
| No secret collection | This website | Available in current prototype | No form on this site asks for passwords, tokens, network inventories or logs. |
| Security headers | This website | Available in current prototype | nosniff, frame restriction and a strict referrer policy on every response. |
| Short-lived maintenance credentials | Platform | Available in current prototype | Maintenance access by short-lived certificates, with one offline break-glass key. |
| Continuous correlated audit | Platform | Available in current prototype | Append-only audit correlated either side of any trigger. |
| Integrity baselines accepted by name | Platform | Available in current prototype | No bulk re-baselining; each change reviewed. |
| Declared changes | Platform | Available in current prototype | Every deliberate change to a monitored system is declared before it is made. |
| Engine–policy separation | Platform | Available in current prototype | The component that analyses cannot execute; the component that executes cannot analyse. |
| Isolation of automated analysis from actuators | Platform | Available in current prototype | Analysis outputs are proposals; actuators accept only policy-approved, signed decisions. |
| Defence against log-borne injection | Platform | Available in current prototype | Attacker-written content is data, never instruction. |
| Signed offline updates with anti-rollback | Appliance | Available in current prototype | Detached signatures, published checksums, version floor. |
| Secure and measured boot | Appliance | Available in current prototype | Every stage of the boot chain verified and measured. |
| Hardware-backed secrets | Appliance | Available in current prototype | Keys held in TPM-backed hardware storage. |
Contact abuse, injected content, dependency compromise, administrative access, domain and DNS compromise, and tampering with published update information. The site is static, loads nothing from third parties, sets no cookies and accepts no secrets.
There is no endpoint here that configures, contacts or administers a deployed system, and a visit never triggers a download or an installation.
Restore of configuration, policy and evidence is rehearsed, and its result recorded, rather than assumed.
Write to security@jcijb.com. Read the responsible-disclosure policy first; do not send credentials or personal data you do not need to send. The machine-readable contact is /.well-known/security.txt.
Tell us what you need to protect. A briefing is an engineering conversation; it never needs your credentials, network inventories or logs.