Security, stated as facts you can check.
This page lists the controls that are implemented on this website, where each part of Mullusi runs, and how to report a problem. Every fact here is one click from its source.
Not open yet. The hosted product is not publicly available; this page covers the website and the browser demo.
Contact, policy and preferred languages, served at a fixed address.
The authored site includes no analytics code. Hosting may inject scripts; the current Content Security Policy blocks third-party script origins.
The site sets no cookies. Theme and language preferences stay in your browser's local storage.
No form sends data and there is no account. An email exists only when you choose to send it. The separate Gmail read-only pilot is covered on the privacy page.
Your browser sends connection details to the hosting provider to load these pages. This is separate from the browser-only demo inputs.
The headers every page is served with
Each value below is set in the site's _headers file and applied to every response. Compare it with the response headers in your browser's network panel.
| Header | Value | Why |
|---|---|---|
| Content-Security-Policy | default-src 'self'; script-src 'self' 'sha256-JuLIcpX+S3DJkKMQrmkSbK7ftWzHckaT6Qk3EBuPLw4='; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'none'; require-trusted-types-for 'script'; trusted-types mullusi-lang-adapter mullusi-helper mullusi-fallback; upgrade-insecure-requests | Scripts, styles and fonts load only from this origin. No inline styles; the one hashed inline block is the homepage's structured data. |
| Strict-Transport-Security | max-age=31536000; includeSubDomains; preload | HTTPS only, for a year, subdomains included, with the preload directive set. |
| Referrer-Policy | strict-origin-when-cross-origin | Other sites see at most this origin, never the page you came from. |
| X-Content-Type-Options | nosniff | Browsers keep the declared content type. |
| X-Frame-Options | DENY | No other page can frame this site. |
| Cross-Origin-Opener-Policy | same-origin | Cross-origin windows are isolated; same-origin windows with matching policy may retain access. |
| Cross-Origin-Resource-Policy | same-site | Limits no-cors resource use to same-site pages, which can include subdomains. |
| X-DNS-Prefetch-Control | off | Browsers do not look up the domains of links on these pages in advance. |
| X-Permitted-Cross-Domain-Policies | none | Plug-in clients may not load cross-domain policy files from this site. |
| Permissions-Policy | accelerometer=(), autoplay=(), bluetooth=(), browsing-topics=(), camera=(), display-capture=(), encrypted-media=(), fullscreen=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), xr-spatial-tracking=(), clipboard-read=(), compute-pressure=(), identity-credentials-get=(), keyboard-map=(), otp-credentials=(), publickey-credentials-create=(), storage-access=(), sync-xhr=(), unload=(), window-management=(), clipboard-write=(self) | The site uses only clipboard writes, on an explicit click. |
| Speculation-Rules | "/assets/speculation-rules.json" | Browsers that support it may load a page of this site just before you open its link, so it opens sooner. Nothing from other sites is loaded. |
| Cache-Control | public, max-age=0, must-revalidate | Pages are revalidated on every visit; other paths set their own rule in the same file. |
Pages are static files on Cloudflare Pages, built on GitLab after the release checks pass. There is no server-side code on this site.
What runs where
Three parts, each with its own place and state.
| Part | Runs on | State |
|---|---|---|
| This website | Cloudflare Pages, static files only | Available |
| Browser demo | Your browser; evaluating a scenario sends no request | Available |
| Hosted product | The hosted product, API and dashboard are not publicly available | Not yet |
Evidence details (for auditors)
Witness states for each Mullusi hostname, in the vocabulary of status.json.
| Surface | State | Security boundary |
|---|---|---|
mullusi.com | Published | Static public website with security headers and no public account session. |
docs.mullusi.com | Published externally | Public documentation route; header ownership may differ from this repository. |
api.mullusi.com | AwaitingEvidence | Public API security status remains staged until runtime witness evidence closes. |
dashboard.mullusi.com | Reserved | Operator surface; not open as a public website service. |
Report a vulnerability
Report suspected issues on public website routes privately; the full policy is on the responsible disclosure page.
Scope: Public website routes only. Reserved services are not targets. No public bounty program is promised by this page.