# Security Policy

## Reporting a vulnerability

If you discover a security issue affecting `ceskacan.com` or this portfolio repository, please report it privately by email:

- **Email:** sadktyk@gmail.com
- **Subject:** `[SECURITY] ceskacan.com`

Please include the affected URL or file, a concise description, reproduction steps, and the potential impact. Avoid opening a public GitHub issue for vulnerabilities that could expose user data or enable abuse.

## Scope

In scope:

- `https://ceskacan.com/`
- `https://ceskacan.com/en.html`
- Contact-form client validation and redirects
- First-party portfolio telemetry integration
- Files and workflows in this repository

Third-party services such as GitHub Pages, FormSubmit, LinkedIn, GitHub, and Supabase infrastructure are governed by their own security programs; reports about configuration mistakes in this portfolio are still welcome.

## Security posture

- Static-site delivery; no application server executes arbitrary user input.
- External links opened in a new tab use `rel="noopener noreferrer"`.
- Contact inputs use browser validation, length limits, and a honeypot field.
- Analytics stores aggregate event data and a one-way client hash rather than raw client IP addresses.
- The analytics table is protected with RLS and is not readable/writable by public `anon` or `authenticated` roles.
- CI runs build checks, live-link health checks, Lighthouse budgets, and scheduled cross-browser tests.