Security & privacy
What this site does — and what it never does.
This page is the readable version of the machine file at /.well-known/security.txt. Both say the same thing; this one says it to a person.
CookiesNone. Not first-party, not third-party, not "essential".
TrackingNo analytics beacons, no pixels, no fingerprinting scripts.
ScriptsOne first-party file. The only outside origin is Cloudflare Turnstile, loaded on the two forms to stop bots.
PolicyA sealed Content Security Policy: default-src 'none', scripts and styles from this domain only, no framing, no objects.
TransportHTTPS only, TLS 1.2 or newer, served from Cloudflare's edge as a static site.
Your inputThe Signal Room, the Morse tools and the Lieutenant run entirely in your browser. Nothing you type there leaves your device.
The formsThe contact form and the Wall relay your message to Aaron's phone through a small first-party function. Nothing is stored on this site, and nothing is fed to a model.
Email & phoneUsed only to write back to you. They are never published, sold, or shared.
Found something?
If you find a weakness in this site, its forms, or its headers, write to azigabe@vaultrec.com with what you saw, where, and how to reproduce it. Good-faith reports are read personally and answered — usually within three days. Please do not test the forms with other people's real data; a made-up name and your own address are all a proof needs.
Scope: vaultrec.com and its subdomains that serve this site. Anything on a subdomain that asks you to sign in is private infrastructure and out of scope.
Back to the door