Contact us
MenuClose
Security

Security at Half Bell

What we do to protect this website and our delivery pipeline, and how to tell us about a problem.

Last updated 2 November 2026.

Security lead

David Lass, founder and delivery lead, is Half Bell's security lead and is accountable for the practices described on this page. Contact: [email protected].

Reporting a vulnerability

Email [email protected] with the details and how to reproduce the issue. Our contact details are also published in security.txt. We will acknowledge good-faith reports, and we ask that you test only against your own accounts, avoid accessing other people's data, and give us reasonable time to fix a problem before disclosing it. We do not run a paid bounty programme.

This website

  • The public site is static, with no JavaScript by default, no database and no user accounts.
  • A strict Content Security Policy (script-src 'self'), HSTS, X-Content-Type-Options, X-Frame-Options: DENY, a restrictive Referrer-Policy and Permissions-Policy are sent on every response.
  • The site is delivered through Cloudflare. The web server has no public ports: only the Cloudflare tunnel reaches it.
  • Containers run with a read-only filesystem, all Linux capabilities dropped, no-new-privileges and memory and CPU limits.
  • The tunnel credential is stored on the server with restricted permissions and never in the repository.

Deployment

  • Every change is type-checked, built and tested in an automated pipeline before it is deployed, including checks that the content security policy and private areas are intact.
  • The deploy key can run a single, fixed deploy command on the server. A release that fails its health check is rolled back automatically.
  • Our deployment runs under its own account and project, separate from other services on the same host.

What we do not claim

Half Bell holds no security certification, including Cyber Essentials and ISO 27001, and is not a certified penetration-testing firm. If a client needs a formal penetration test for compliance, we say so and help prepare for it.