Security
Scult's approach to keeping this site — and the work we build for clients — secure.
How this site is secured
Every response from scult.in carries the following HTTP security headers:
Content-Security-Policy
Restricts which sources scripts, styles, images, and connections can load from, blocking most injected third-party code.
X-Content-Type-Options: nosniff
Stops browsers from guessing a file's type, preventing disguised files from being executed as scripts.
X-Frame-Options: DENY
Blocks the site from being loaded inside a frame on another site, preventing clickjacking.
Referrer-Policy: strict-origin-when-cross-origin
Limits how much referrer information is sent to other sites when a visitor navigates away.
Permissions-Policy
Disables camera, microphone, and geolocation access — the site never requests any of them.
Strict-Transport-Security
Forces every visit over HTTPS, including subdomains, for a long-lived period going forward.
Reporting a vulnerability
If you believe you've found a security issue on scult.in, we want to know. Email connect@scult.in with details, and we'll respond as soon as we can. Our machine-readable disclosure policy is also published at /.well-known/security.txt per RFC 9116.
Data handling
We treat client and site data as need-to-know: access is scoped to what a given project requires, and environment variables and secrets are kept out of source control rather than committed to the codebase.