Configuration
Runtime configuration comes from environment variables, with safe deployment defaults when a value is absent.
Security
Every request crosses six layers before it reaches us.
Deinox applies layered controls to reduce common web risks and protect user interactions. This page describes what those layers are, and how to report something we have missed.
Checking platform status
Technical controls
The request path
Each layer runs in this order, and a request has to clear all of them before anything is processed.
Inbound request Any visitor, any origin, trusted or not.
-
default-src 'self'
L1Security headers
Helmet sets a strict content security policy, blocks framing, and suppresses the referrer on outbound links.
-
600/15min · 60/10min
L2Rate limiting
Every IP is metered at the edge, with a tighter window again on the API routes behind it.
-
12 KB body cap
L3Request hardening
Duplicated query parameters are collapsed before they reach a handler, and request bodies are capped.
-
403 on mismatch
L4Origin checks
Submissions arriving from an origin outside the allow-list are refused before any processing happens.
-
parameters withheld
L5Bot resistance
A hidden trap field and submission timing checks screen out automated posts. The parameters stay unpublished on purpose.
-
strip · escape · validate
L6Sanitize and validate
Markup is stripped, entities escaped, lengths capped, and every field validated server-side before storage.
Application Only what survives all six layers gets here.
Operational controls
What holds around the code
Audit trail
Contact submissions are stored as timestamped records, so an enquiry can be traced after the fact.
Error handling
Failures return a generic response. Stack traces and internal implementation details are never surfaced.
Disclosure route
A dedicated security contact is published at a well-known path, so reports never depend on finding the right inbox.
Responsible disclosure
Found something? Tell us privately first.
Report it to us before anywhere else, and give us enough to reproduce it. We would rather hear about a problem early than read about it later.
What to include
- Reproduction stepsEnough detail for us to see the same behaviour you saw.
- Impact descriptionWhat an attacker could actually do with it.
- Mitigation suggestionsAnything you would change, if you have a view.
Where to send it
Security contact details are published at the well-known path below.
/.well-known/security.txt
- Policy/security.html
- Canonical/.well-known/security.txt
- Languagesen
- Expires2027-12-31