Security and trust
What this site does with you, and what we do with your systems.
Written for the person who checks response headers before they book a call. Everything here is verifiable from outside: open the network panel, read the headers, check the booking page's origin.
Updated 2026-10-28
This website
Almost nothing to protect, by design.
- Architecture
- A static site. No server-side code, no database, no user accounts, no forms that post to us. Every page is a prebuilt file served from Cloudflare's edge.
- Data we collect
- None directly. We set no cookies. Traffic measurement uses Cloudflare Web Analytics, which is cookieless and does not fingerprint or track visitors across sites.
- Third parties on the page
- Two. The cal.com booking embed, loaded only from cal.com's own origin, so you can pick a time without leaving the page. Cloudflare Web Analytics for aggregate page counts. Fonts are served from this domain, not from a font network.
- Booking data
- When you book, your name, email and answers go to cal.com and to our calendar. We use them to run the call and nothing else. Ask and they are deleted.
- hello@darkoai.org is hosted with an end-to-end encrypted mail provider. Send nothing sensitive before we have agreed a channel for it.
- Transport
- HTTPS only, with HSTS preloading requested, so a browser that has seen the site once will refuse to load it insecurely.
Response headers
The headers every page ships.
Check them yourself from any terminal:
curl -sI https://www.darkoai.org/ | grep -iE "security|policy|options"
Content-Security-Policy- Hash-allowlisted inline scripts (no 'unsafe-inline' for script), external scripts only from this origin, cal.com and Cloudflare Insights. Framing of this site is refused, objects are refused, base URI is pinned, insecure requests are upgraded.
Strict-Transport-Security- max-age one year, includeSubDomains, preload.
X-Frame-Options- DENY, as the legacy twin of frame-ancestors 'none'.
X-Content-Type-Options- nosniff.
Referrer-Policy- strict-origin-when-cross-origin: the page you came from is never sent to another site in full.
Permissions-Policy- Camera, microphone, geolocation, payment, USB, sensors and the browsing-topics advertising API are all switched off for this origin.
Cross-Origin-Opener-Policy- same-origin, so a page we open cannot reach back into this one.
Client systems
How we behave inside your infrastructure.
- Your accounts, your keys
- Systems are built in accounts you own, on credentials you issue. We never hold the only copy of a credential, and nothing we build depends on an account of ours staying alive.
- Least privilege, in writing
- The blueprint names every system the build touches and the exact permission it needs. Read-only first; anything beyond that is agreed per system and revoked by you at the end.
- Secrets never in code
- Credentials live in your secret store or environment, never in a repository, a prompt or a log. Our pipelines redact secrets from run journals before they are written.
- Limits in code
- Per-day ceilings, spend caps, one-shot rules and a kill switch you own are enforced in the runner, not requested in a prompt. A model can be talked into anything; a counter cannot.
- Gates fail closed
- A stage that cannot verify its output stops and says so. Nothing is logged-and-shipped-anyway.
- Ownership and handover
- Repository, deployment and runbook are yours at handover. The runbook is written on the assumption that we are gone.
- Supply chain
- Dependencies are pinned and lock-filed; nothing is adopted the day it is released. The model chain is re-benchmarked when a provider changes under it, because a shipped chain is a claim, not a state.
Vulnerability disclosure
Found something? Tell us first.
Email hello@darkoai.org with "Security report" in the subject. We acknowledge within two working days, fix what is real, and credit you if you want it. Our security.txt carries the same contact.
Please do not test against client systems we operate; those have their own owners and their own disclosure routes.
The evidence rule
We publish operating parameters, dated measurements and systems we actually run. We do not publish results we cannot show the log for, and this site has no testimonial wall for that reason.
That applies to this page too. If a claim above stops being true, the page changes the same day.
Ask us on a call