Current design

Pergola Wiki is a static bilingual knowledge base with no accounts, server-side forms, advertising scripts or third-party analytics scripts. Search data is delivered as a first-party external script so the browser can enforce a strict policy that does not allow inline executable scripts.

How browser data is handled

The classification assistant, evidence checker, inspection log, accessibility barrier-report builder and reviewer workbench process entries only in the current browser. Downloads are created temporarily by the browser; the site does not submit these entries to a Pergola Wiki application endpoint.

Hosting boundary: Hosting and content-delivery services may still process ordinary request metadata and server logs under their services. The absence of site-operated analytics is not represented as an absence of all network logging.

Response headers configured by this release

Release v2.3 browser security response-header configuration
HeaderConfigured value
Strict-Transport-Securitymax-age=31536000
Content-Security-Policydefault-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; media-src 'self'; frame-src 'none'; worker-src 'self'; manifest-src 'self'; upgrade-insecure-requests
X-Content-Type-Optionsnosniff
X-Frame-OptionsDENY
Referrer-Policystrict-origin-when-cross-origin
Permissions-Policyaccelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Cross-Origin-Opener-Policysame-origin
X-Permitted-Cross-Domain-Policiesnone

These headers enforce HTTPS use, restrict executable-script sources, prevent embedding, remove unnecessary device permissions and reduce cross-window attack surface. Live response headers must be inspected at the canonical HTTPS URL after deployment; source configuration alone is not proof of delivery.

Independent verification

  1. Inspect the canonical HTTPS response and compare every expected header with the machine-readable posture record.
  2. Test search, local tools, downloads, images and styles while the Content Security Policy is enforced.
  3. Use release.json and SHA256SUMS to check release identity and byte integrity for public machine files.

What is not claimed

  • No independent penetration test, security certification or bug-bounty program is currently recorded.
  • No dedicated public security contact is yet published, so a security.txt file with a non-functional Contact field is not invented.
  • HSTS does not claim subdomain coverage or preload-list enrollment.
  • Browser headers do not prove hosting-account security, eliminate every vulnerability, validate technical content or constitute a third-party security audit.