Trust
Security
How StudioKing is built, hosted and tested, in plain terms. Report anything you find to [email protected].
Hosting and transport
- The app and its API run on Cloudflare: static files on Pages, the API as functions at the edge. There is no separate server to patch.
- HTTPS only, with HTTP Strict Transport Security for a year, including subdomains.
Security headers
Every page is served with these headers (read from the deployed configuration):
| Header | Value |
|---|---|
Content-Security-Policy | default-src 'self'; script-src 'self' 'sha256-v1PodvongULJBlY4vQIZ5Q1sfKHgzGDzrwLSrLXtAr0=' https://static.cloudflareinsights.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' https://cloudflareinsights.com; worker-src 'self'; manifest-src 'self'; media-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'; object-src 'none'; upgrade-insecure-requests |
Cross-Origin-Opener-Policy | same-origin |
Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=() |
X-Permitted-Cross-Domain-Policies | none |
X-DNS-Prefetch-Control | off |
X-Frame-Options | DENY |
X-Content-Type-Options | nosniff |
Referrer-Policy | strict-origin-when-cross-origin |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
The content security policy allows scripts from StudioKing itself, the one boot script by its hash, and the Cloudflare Web Analytics beacon. No other inline scripts, no eval, no framing, no plugins, and no advertising or tracking scripts, third-party fonts or styles.
Data minimisation
- No accounts for visitors, no advertising and no cross-site tracking. Page views are counted in aggregate with Cloudflare Web Analytics, which uses no cookies or browser storage and does not fingerprint visitors.
- Your work stays in your browser unless your team signs in to share it. See Data and privacy.
Team libraries
- Each team's library is private. Reading or writing it requires signing in through Cloudflare Access, and the API verifies the sign-in token's signature, audience and expiry again in code.
- Each team has its own member list (people or whole email domains). A signed-in person who is not on a team's list cannot read it, change it or send its sign-off links. Members are set by a Nirvani operator.
- Writes merge on the server: newest change wins per kit, and a kit is removed only by an explicit deletion. A browser that has fallen behind cannot overwrite the team's work.
Hosted links
- Every input is validated against the engine's own tables: recipe ids, palettes, colours, classes, selectors, overlay names and number ranges. Kit names are reduced to plain text before they reach any stylesheet or script.
- The automated suite tries script, style and selector injection through every parameter and through stored kits on every release.
- The API is read-only and anonymous, with errors never cached.
Build and release
- No runtime dependencies: the app is hand-written HTML, CSS and JavaScript.
- Build actions are pinned to exact versions and watched for updates.
- Only an allow-listed public folder is deployed, and internal paths are refused at request time.
- Every release runs an engine self-test, an API contract suite and a real-browser suite with axe-core accessibility scans, under the production security policy.
Report a vulnerability
Email [email protected]. Our security.txt has the same contact. Please do not test in ways that degrade the service or touch other customers' data.