Security at GuruKnight
Protection isn't a feature we bolt on — it's a principle we build on.
Last updated: October 13, 2026
Our Approach
Security at GuruKnight rests on the same principles as our products: simplicity, honesty, and defense in depth. This page describes the protections currently in place for guruknight.com and our plans as products launch.
Current Protections (Website)
- HTTPS everywhere: all traffic is encrypted in transit; HTTP requests are redirected.
- HSTS (Strict-Transport-Security): browsers are instructed to only ever connect over HTTPS.
- Content-Security-Policy: restricts which resources the browser may load, mitigating cross-site scripting (XSS) and injection attacks.
- X-Content-Type-Options: nosniff — prevents MIME-type confusion attacks.
- X-Frame-Options: DENY — the site cannot be embedded in frames, blocking clickjacking.
- Referrer-Policy: strict-origin-when-cross-origin — limits how much referrer data leaks to other sites.
- Permissions-Policy: unused browser features (camera, microphone, geolocation) are explicitly disabled.
- Minimal attack surface: the site is fully static — no server-side application logic, no user accounts, no database.
- Careful client scripting: all interactive scripts are first-party, reviewed, and avoid dangerous DOM patterns.
Data Handling
The website currently stores no personal data on our servers. The contact form is not yet active; contact happens through your own email client. See the Privacy Policy for what is collected (e.g., anonymized analytics) and why.
Future Commitments (Products)
As products launch, our security program will grow with them:
- Privacy-first analytics with data minimization
- Strong authentication (Argon2id/bcrypt hashing + MFA) for any accounts
- PCI-DSS-compliant payment processors — we never store card data
- Regular dependency updates and automated vulnerability scanning
- Encryption of sensitive user data, in transit and at rest
Responsible Disclosure
Found a vulnerability? Do not open a public issue.Email [email protected] with:
- A description of the issue and its impact
- Steps to reproduce (or a proof of concept)
- Affected URLs/pages
We commit to acknowledging reports within 5 business days, keeping you informed of progress, and publicly crediting reporters (if they wish) once a fix is released. Please give us a reasonable time to fix issues before any public disclosure, and avoid tests that degrade our services or affect real users.
Contact
Security questions or reports: [email protected].