Security
How this site is secured
We advise clients on their security, so it is fair to ask what we do for our own website. This page says so in terms you can check yourself, against the live site.
What this site is
Files, not an application
Every page on thinksmart.eu is an HTML file, written out in advance by a build step and served as it is. There is no content management system on the public side, no database and no server-side rendering. What you read is what was built.
JavaScript is optional. Every page reads, navigates and switches language without it; the script only adds behaviour to something that already works.
The API has two endpoints a visitor's browser talks to: the contact form (/api/contact) and the short-lived challenge it uses (/api/challenge). Both are described below. Everything else a visitor reaches is a file.
Response headers
What every response carries
Sent with every page and every file. Open the network panel of your browser, or run curl -I https://thinksmart.eu/, and compare.
| Header | Value |
|---|---|
Content-Security-Policy | The whole policy, directive by directive, is in the next table. |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | accelerometer=(), autoplay=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=(), xr-spatial-tracking=(), interest-cohort=() |
Cross-Origin-Opener-Policy | same-origin |
Cross-Origin-Resource-Policy | same-origin |
X-Powered-By | Removed. The platform adds it by default, and it names the software stack to anyone who asks. |
Content Security Policy
What a page may load, directive by directive
The policy is generated from the pages that were built. The one hash is the single inline script every page carries; no other script may run. Scripts, styles, fonts, images and connections are limited to this origin.
| Directive | Value |
|---|---|
default-src | 'self' |
base-uri | 'self' |
object-src | 'none' |
frame-ancestors | 'none' |
frame-src | 'none' |
script-src | 'self' 'sha256-VNIA72ttmp3r9LQua08rreePojz9lQk1zVXM5Y0bTT8=' |
style-src | 'self' 'unsafe-inline' |
font-src | 'self' |
img-src | 'self' data: |
connect-src | 'self' |
form-action | 'self' |
manifest-src | 'self' |
worker-src | 'self' |
upgrade-insecure-requests | No value: the directive is the instruction. |
The one concession is 'unsafe-inline' for styles: a few layout values are set with a style attribute, and CSP has no hash for attributes. Inline script is not allowed anywhere.
Transport
Encrypted, and only encrypted
HTTPS only. Plain HTTP is answered with a redirect and never with content.
HSTS for two years, subdomains included: a browser that has seen this site once will not try HTTP again.
TLS 1.2 is the minimum. Older versions are refused at the platform edge.
Issued by DigiCert, managed and renewed by the platform. One certificate per hostname, thinksmart.eu and www.thinksmart.eu.
The DNS zone is signed with DNSSEC, so the answer to "where is thinksmart.eu" cannot be forged on the way to you. Check with dig +short thinksmart.eu DS.
Mail from thinksmart.eu is covered by SPF and by DMARC with a reject policy: dig +short TXT _dmarc.thinksmart.eu.
Third parties
What we do not load
Nothing on this site is loaded from another domain. No third-party scripts, no fonts from a font service, no images from a content delivery network, no embedded video, no chat widget. The Content Security Policy above enforces this; it is not a matter of discipline.
There is no analytics on this site at all, from anyone. No page view is counted, by us or by a third party.
The site sets no cookies. Your browser's storage holds at most two things, both on your device and neither of them sent anywhere: the language you chose, and which hero photograph was shown last.
The contact form
One e-mail, nothing stored
A message from the contact form is relayed as one e-mail to the mailbox configured for enquiries, through Azure Communication Services, Europe data location, with your address as the reply-to. It is stored nowhere: no database, no CRM, no form service.
Before it is relayed: a hidden field catches automated submissions; control characters are stripped so nothing can inject a mail header; a size limit applies; the number of messages per address per ten minutes is limited; and a time trap refuses a submission made within seconds of the form being opened, which people do not do and scripts do.
- The platform keeps no access logs for this site. What a visitor reads is not recorded.
- The contact function logs that a message was relayed, never what it said or who sent it.
Hosting and access
Where it runs, and who can change it
Azure App Service (Linux), inside the European Union. The site runs as a single Node.js process that serves pre-built files and applies the response headers. The platform hostname redirects to thinksmart.eu, so there is one address.
- Publishing needs a Microsoft Entra identity with a role on the subscription. There is no deployment password, no FTP and no basic authentication.
- The management endpoint of the web app accepts connections from one administrative address only.
- A deployment replaces the whole site. Nothing from an earlier build stays behind.
- Azure Policy refuses any resource outside European Union regions, and any resource type the site does not need.
- The production resource group carries a delete lock. Role changes, policy changes, lock removals and deletions raise an alert.
Source and dependencies
A short supply chain
The site is generated from plain text files in a private repository. The generator has build-time dependencies only; nothing from a package registry runs on the server or in your browser. The API that handles the contact form has no dependencies at all.
The editor used to change the text is served from this origin, pinned to a version and checked in, rather than loaded from a content delivery network. A third-party script with write access to a site's repository is the supply-chain shape we advise clients against.
Check it yourself
Six commands
curl -I https://thinksmart.eu/shows the headers above.curl -sI http://thinksmart.eu/ | head -1shows the redirect from plain HTTP.openssl s_client -connect thinksmart.eu:443 -tls1_1fails, as it should.dig +short thinksmart.eu DSshows the DNSSEC delegation.dig +short TXT _dmarc.thinksmart.eushows the DMARC policy.curl https://thinksmart.eu/.well-known/security.txtshows where to report a finding.
Reporting a weakness
If you find something, we want to hear it first
The route in is security.txt, and the responsible disclosure section of our terms of use says what is in scope and what we commit to in return. The address is info@thinksmart.eu.