Scult's approach to keeping this site — and the work we build for clients — secure.
Every response from scult.in carries the following HTTP security headers:
Restricts which sources scripts, styles, images, and connections can load from, blocking most injected third-party code.
Stops browsers from guessing a file's type, preventing disguised files from being executed as scripts.
Blocks the site from being loaded inside a frame on another site, preventing clickjacking.
Limits how much referrer information is sent to other sites when a visitor navigates away.
Disables camera, microphone, and geolocation access — the site never requests any of them.
Forces every visit over HTTPS, including subdomains, for a long-lived period going forward.
If you believe you've found a security issue on scult.in, we want to know. Email connect@scult.in with details, and we'll respond as soon as we can. Our machine-readable disclosure policy is also published at /.well-known/security.txt per RFC 9116.
We treat client and site data as need-to-know: access is scoped to what a given project requires, and environment variables and secrets are kept out of source control rather than committed to the codebase.