commit 01cecbe799fc8618c9d0a08e2f2d7646b5bc85ff Author: httpjamesm <51917118+httpjamesm@users.noreply.github.com> Date: Thu Dec 29 12:08:36 2022 -0500 Initial Home page diff --git a/Security.md b/Security.md new file mode 100644 index 0000000..6ca90a2 --- /dev/null +++ b/Security.md @@ -0,0 +1,6 @@ +AnonymousOverflow takes security seriously and uses multiple redundant measures to prevent XSS attacks on the client. + +* Templating engine is used for many variables that automatically sanitizes them and prevents any rogue code from being executed +* Many variables are internally sanitized with Go's `html.EscapeString()` API when being directly served to the client +* Strict XSS prevention headers are sent to the client on every non-static file request +* CSPs are added on every page that denies all scripts from running, either first-party or otherwise, and default to `none`, preventing third-party connections, iframe attacks, inline attacks, etc. \ No newline at end of file