Security

What This Page Is

This page describes concrete, checkable technical controls this site actually runs — not a marketing claim you have to take on faith. Everything below can be verified yourself: open your browser's developer tools, check the Network tab response headers, or run this domain through a header-analysis tool.

Content Security Policy

Every page is served with a restrictive Content Security Policy. Scripts can only load from this site itself and a small, explicit allowlist of Google advertising and analytics domains — nothing else is permitted to execute, regardless of where it's injected from. Any script that isn't on that allowlist is blocked by the browser before it can run, not filtered after the fact.

Violations are reported back to us automatically via the browser's Reporting API, so if something ever attempts to load a script outside the allowlist, we get notified.

Security Headers

This site sets the full standard set of browser security headers on every response:

• Strict-Transport-Security — forces HTTPS, including subdomains
• X-Content-Type-Options — blocks MIME-type sniffing attacks
• X-Frame-Options — prevents this site from being embedded in a hidden iframe (clickjacking)
• Referrer-Policy — limits what's leaked to other sites via the referrer header
• Permissions-Policy — disables camera, microphone, geolocation, and other browser APIs this site has no reason to request
• Cross-Origin-Opener-Policy — isolates this site's browsing context from cross-origin windows

Advertising

Ads are served exclusively through Google AdSense, which runs its own ad-quality and malware review on creatives before they're served. We don't accept ads from any other network or direct advertiser, which keeps the set of parties able to serve content on this site small and accountable. Combined with the script allowlist above, an ad script has no path to load or execute code outside what Google's own ad infrastructure serves.

Dependency Patching

Third-party code this site depends on is monitored continuously for known vulnerabilities and patched on an ongoing basis, not just when something breaks. All dependencies are kept current against published security advisories.

What We Don't Claim

We don't run a proprietary malware scanner, and we're not going to claim one exists. The controls on this page are standard, well-understood browser security mechanisms, correctly configured and actually enforced — not a black-box detection system you have to trust without being able to check it yourself.

Report a Security Issue

Found a vulnerability, a misconfigured header, or something that shouldn't be able to load on this site? Please report it to contact@unscramble.fyi. We take security reports seriously and will respond promptly.