Security approach

The generator is intentionally static. There is no login, database, file-upload endpoint, payment flow, server-side QR processor or administrative interface. Removing these components materially reduces common attack paths such as SQL injection, authentication abuse and malicious server uploads.

Application controls included

• A restrictive Content Security Policy and related browser security headers.
• Only local JavaScript, CSS, images and fonts are allowed.
• Frames, plug-ins, background network connections and form submissions are blocked.
• Uploaded logos are read locally, limited to 1 MB, and restricted to PNG, JPG and WebP.
• SVG logo uploads are blocked to avoid active-content risks.
• User-entered QR content is never written into page HTML.
• Only GET, HEAD and OPTIONS requests are permitted by the supplied Apache rules.

Denial-of-service protection

No HTML or JavaScript file can independently stop a network-level distributed denial-of-service attack. Public deployment should place the site behind the hosting provider’s CDN, WAF and rate-limiting layer. The origin server should accept public web traffic only from that edge service where the provider supports origin restriction.

Operational safeguards

1. Serve the public site only over HTTPS.
2. Enable edge caching for HTML and long caching for versioned static assets.
3. Enable bot management, connection limits and request-rate rules at the edge.
4. Monitor bandwidth, status codes and request spikes.
5. Keep Apache or Nginx and the operating system patched.
6. Do not add unnecessary PHP scripts, forms, databases or admin panels to this hostname.

Reporting a vulnerability

Before public launch, replace the placeholder email in .well-known/security.txt with an actively monitored security contact.