Security
How this site is secured
The same measures we apply to client projects. Everything on this page is implemented here — you are reading it over a connection that uses all of it.
Transport
- HTTPS everywhere, with HTTP permanently redirected
- HSTS with a two-year max-age and includeSubDomains
- TLS certificates renewed automatically
Browser hardening
- Content-Security-Policy with a fresh nonce on every request — no unsafe-inline scripts
- X-Content-Type-Options, X-Frame-Options and Referrer-Policy set on every response
- Permissions-Policy denying camera, microphone and geolocation
Credentials
- Passwords stored as scrypt hashes, never in plain text and never recoverable
- Server-side sessions holding only a SHA-256 hash of the cookie value
- Per-account lockout and per-IP rate limiting on sign-in
- Login responses that do not reveal whether an email address exists
Application
- Parametrised SQL throughout — no string-built queries
- Every portal query scoped to the signed-in client's own records
- Rate limiting and a honeypot on public forms
- Forward-only database migrations, reviewed before release
Monitoring
- Scan and injection attempts recorded with source, path and rule matched
- Hostile requests answered with a plain 404, revealing nothing
- Security events pruned on a retention schedule
Reporting a vulnerability
If you believe you have found a security issue in this site or in something we built, please email info@nepalwebsites.com with enough detail to reproduce it. We will acknowledge your report and keep you updated while we fix it.
Please do not run automated scanners against client sites, access data that is not yours, or degrade service for real users while testing. We will not pursue anyone who reports in good faith and follows that.
Machine-readable contact details are published at /.well-known/security.txt.