If you discover a security vulnerability in this project, please email etceter4@etceter4.com with details. We take security seriously and will respond promptly.

The .htaccess file implements a comprehensive CSP that:

• Restricts script sources to trusted CDNs (jQuery, Velocity.js, Google Analytics)
• Allows frames only from Bandcamp and YouTube for embedded content
• Prevents inline script execution (with exceptions for Google Analytics)
• Blocks object/embed tags to prevent Flash vulnerabilities
• Restricts font and image sources

Note: The CSP currently uses 'unsafe-inline' for scripts due to inline Google Analytics code. For improved security, consider:

• Moving analytics to a separate external file
• Using CSP nonces or hashes for inline scripts
• Implementing Google Tag Manager instead of inline GA code

Additional security headers configured:

• X-Frame-Options: DENY - Prevents clickjacking attacks
• X-Content-Type-Options: nosniff - Prevents MIME type sniffing
• X-XSS-Protection: 1; mode=block - Enables browser XSS protection
• Referrer-Policy: strict-origin-when-cross-origin - Controls referrer information
• Permissions-Policy - Restricts access to sensitive browser features

HSTS (HTTP Strict Transport Security) is prepared in .htaccess but commented out.

Action Required: Uncomment the HSTS header once HTTPS is fully deployed:

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

• All dependencies are up-to-date with no known vulnerabilities
• Automated dependency updates via Dependabot
• Weekly security audits in CI/CD pipeline
• CDN resources use Subresource Integrity (SRI) hashes

Run security audits regularly (recommended: weekly or before releases):

# Check for vulnerabilities
npm audit

# Fix automatically fixable vulnerabilities
npm audit fix

# Review what would change (dry run)
npm audit fix --dry-run

# Force fix breaking changes (use with caution)
npm audit fix --force

1. Critical/High Severity: Address immediately

   • Update the affected package
   • If no fix available, consider removing or replacing the dependency
   • Create a GitHub issue to track resolution

2. Medium Severity: Address within 1 week

   • Schedule update in next sprint
   • Document any workarounds in use

3. Low Severity: Address within 1 month

   • Include in regular dependency updates
   • Monitor for severity escalation

The CI pipeline runs npm audit on every push and pull request:

• Build fails if critical vulnerabilities are detected
• Security scan results are uploaded as artifacts
• Dependabot creates automatic PRs for vulnerable dependencies

Before updating dependencies:

1. Review the changelog for breaking changes
2. Check the package's security history on npm/GitHub
3. Verify the package is actively maintained
4. Test thoroughly in development before merging

1. Inline Scripts in HTML

   • Issue: Google Analytics uses inline scripts
   • Impact: Requires 'unsafe-inline' in CSP, reducing security
   • Recommendation: Move to external GA file or implement GTM

2. Global Scope Usage

   • Issue: JavaScript uses global scope for cross-file communication
   • Impact: Potential for variable collisions, no-undef check disabled
   • Recommendation: Migrate to ES6 modules or implement a module bundler (Webpack/Rollup)

3. jQuery 3.7.1

   • Status: Current, but older version
   • Recommendation: Monitor for jQuery security updates or consider migrating to vanilla JS

1. Legacy HTML Files

   • Issue: Some files (loophole.html, OGOD.html, sitemap.html) have malformed HTML
   • Impact: Potential XSS risks if user input is involved
   • Recommendation: Validate and fix HTML syntax

2. HTTP URLs in iframes

   • Issue: Bandcamp iframes use http:// instead of https://
   • Impact: Mixed content warnings when served over HTTPS
   • Recommendation: Update to HTTPS URLs

3. Server Signature

   • Status: Disabled via .htaccess
   • Note: Verify Apache is configured to respect this setting

1. Never commit sensitive data:

   • API keys, passwords, or tokens
   • Personal information
   • Database credentials

2. Validate all user input:

   • Sanitize HTML content
   • Use parameterized queries (if backend is added)
   • Validate file uploads

3. Keep dependencies updated:

   • Run npm audit before committing
   • Review Dependabot PRs promptly
   • Test thoroughly after updates

4. Follow secure coding practices:

   • Use const for values that don't change
   • Avoid eval() and similar dangerous functions
   • Implement proper error handling

• No hardcoded secrets or credentials
• All external resources loaded over HTTPS
• User input properly sanitized
• CSP rules updated if adding new content sources
• Dependencies reviewed for vulnerabilities
• Code reviewed by at least one other person
• Security implications documented

• 2024-10: Comprehensive security audit and modernization
  • Updated all dependencies
  • Fixed 9 security vulnerabilities (4 high-severity)
  • Implemented security headers
  • Added CSP
  • Configured automated security scanning

Last Updated: February 2026