Security & Compliance
Security Architecture & Hardening Guide
By adopting a 100% static architecture, the threat landscape is drastically minimized. Learn how to apply modern HTTP security headers.
Recommended
Content Security Policy (CSP)
Static sites easily enforce strict CSP headers since all assets are deterministic.
Built-in
Zero SSR Injection Vulnerabilities
No server-side request forgery (SSRF) or Node.js runtime deserialization vulnerabilities.
Automated
Automated Subresource Integrity (SRI)
Static bundles include hashed filenames for guaranteed tamper-proof browser caching.
Recommended HTTP Headers for Static Hosts
Configure your CDN or reverse proxy with these standard security response headers:
text
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Permissions-Policy: camera=(), microphone=(), geolocation=()