Report a concern.

If you believe you have found a weakness in this website, email security@priyatize.com. Include the page, what you observed, and the least detail needed for us to reproduce it. Give us a reasonable time to respond before any public write-up.

A machine-readable contact is published at /.well-known/security.txt, following RFC 9116.

Please do not access data that is not yours, disrupt the service, or test in a way that affects other people. We will not ask you to break the law to demonstrate an issue.

Controls on this site

• TransportThe production site is served over HTTPS, with HSTS set for a year, including subdomains. Preload is not enabled until the domain is ready for it.
• Content typeResponses send X-Content-Type-Options: nosniff, so browsers do not sniff a file into another type.
• ReferrerReferrer-Policy is strict-origin-when-cross-origin. A full address is not sent when you leave the site.
• Browser featuresCamera, microphone, geolocation, payment and similar sensors are switched off by Permissions-Policy.
• Sensitive pagesContact, privacy, cookies, security, accessibility and terms are sent with Cache-Control: no-store.
• FormsEnquiries are checked on the server for shape, length and a real email address. Repeated attempts are limited. Posts that do not come from this site are refused. A hidden field drops simple bots. The message is not stored in a database.
• Third partiesPages and fonts are served from this site. There is no analytics pixel and no advertising tag.
• SurfaceAddresses do not advertise a server language. There is no public login page.
• What we do not claimWe do not display ISO 27001, Cyber Essentials, or any other certification we do not hold.

Framing policy is set by the host that publishes the site. A self-hosted copy should send a frame-ancestors policy of none, or an equivalent clickjacking control, once it is no longer required to sit inside another page.