• No PII Collection: Application does not collect personally identifiable information
• Local Storage Only: All data stored locally in IndexedDB
• Offline-First: No data transmitted without explicit user action
• No Third-Party Trackers: No analytics or tracking scripts

• CSP Enforcement: Strict Content Security Policy headers
• Input Validation: All user inputs sanitized and validated
• XSS Prevention: React's built-in XSS protection + manual validation
• API Whitelisting: Only approved government domains allowed

• No Authentication Required: Public educational content
• API Rate Limiting: Protection against abuse
• CORS Configuration: Restricted cross-origin access

• HTTPS Only: Production requires secure connections
• Subresource Integrity: Critical resources verified
• No Sensitive Data: No passwords or credentials stored

• Email: [email protected]
• GitHub: Private security advisory (preferred)

1. Description of vulnerability
2. Steps to reproduce
3. Potential impact
4. Suggested fix (if available)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Fix Timeline: Based on severity
  • Critical: 24-48 hours
  • High: 7 days
  • Medium: 30 days
  • Low: 90 days

• Coordinated disclosure preferred
• Public disclosure after fix deployed
• Credit to reporter (if desired)

# Nginx security headers
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';";
add_header X-Frame-Options "DENY";
add_header X-Content-Type-Options "nosniff";
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header Permissions-Policy "geolocation=(), microphone=(self), camera=()";

# Never commit .env files
# Use secrets management in production
REACT_APP_API_KEY=<use-secrets-manager>

# Regular security audits
npm audit
npm audit fix

# Update dependencies quarterly
npm update

• ✅ Content Security Policy (CSP)
• ✅ HTTPS enforcement
• ✅ Input sanitization
• ✅ XSS prevention
• ✅ CSRF protection (no server state)
• ✅ Clickjacking protection
• ✅ MIME sniffing prevention
• ✅ Secure headers

• Application errors logged (no sensitive data)
• Failed API requests monitored
• Anomaly detection for unusual patterns

• WCAG 2.1 AA: Accessibility compliance
• OWASP Top 10: Protection against common vulnerabilities
• Privacy-First: No unnecessary data collection

• Monthly dependency scans
• Quarterly penetration testing
• Annual security review

Security Team: [email protected]

Last Updated: 2025-01-01