Current design
Pergola Wiki is a static bilingual knowledge base with no accounts, server-side forms, advertising scripts or third-party analytics scripts. Search data is delivered as a first-party external script so the browser can enforce a strict policy that does not allow inline executable scripts.
How browser data is handled
The classification assistant, evidence checker, inspection log, accessibility barrier-report builder and reviewer workbench process entries only in the current browser. Downloads are created temporarily by the browser; the site does not submit these entries to a Pergola Wiki application endpoint.
Response headers configured by this release
| Header | Configured value |
|---|---|
Strict-Transport-Security | max-age=31536000 |
Content-Security-Policy | default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src 'self'; frame-src 'none'; worker-src 'self'; manifest-src 'self'; upgrade-insecure-requests |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=() |
Cross-Origin-Opener-Policy | same-origin |
X-Permitted-Cross-Domain-Policies | none |
These headers enforce HTTPS use, restrict executable-script sources, prevent embedding, remove unnecessary device permissions and reduce cross-window attack surface. Live response headers must be inspected at the canonical HTTPS URL after deployment; source configuration alone is not proof of delivery.
Independent verification
- Inspect the canonical HTTPS response and compare every expected header with the machine-readable posture record.
- Test search, local tools, downloads, images and styles while the Content Security Policy is enforced.
- Use release.json and SHA256SUMS to check release identity and byte integrity for public machine files.
What is not claimed
- No independent penetration test, security certification or bug-bounty program is currently recorded.
- No dedicated public security contact is yet published, so a security.txt file with a non-functional Contact field is not invented.
- HSTS does not claim subdomain coverage or preload-list enrollment.
- Browser headers do not prove hosting-account security, eliminate every vulnerability, validate technical content or constitute a third-party security audit.