Security

What this site loads, and from where

The pages of blackstarorbital.com are static files. There is no application of ours behind them — no database, no accounts, no login — and the only code we ship is JavaScript served from this domain.

The site is hosted on Wix headless, which means Wix also answers some routes on this hostname that we neither build nor control: its hosted checkout, its platform APIs, and its own error page. Everything below describes the pages this site publishes. What Wix serves alongside them is set out under what we do not control, listed rather than left for you to find.

All executable code on our pages is same-origin

No page this site publishes loads a script, stylesheet or font from a third party. The Wix SDK used for content and forms is vendored into this repository at pinned versions, published from /assets/sdk/, and verified byte for byte against a recorded hash on every build. A build in which any of those pages loads executable code or styling from another origin fails and is never published.

Content-Security-Policy

Every page declares a policy. script-src is 'self' plus an explicit SHA-256 hash for each inline script — there is no 'unsafe-inline', so script injected into a page does not execute. The hashes are generated at build time and the build fails if any inline script is not covered by one.

The policy is delivered as a <meta> element because the hosting platform does not expose response headers to us. That has one consequence worth stating plainly: frame-ancestors and HSTS cannot be set in a meta policy, so this page does not claim them.

Outbound connections from our pages

On the pages this site publishes, a visitor's browser contacts three hosts besides this one, all Wix, all first-party to the platform that hosts the site:

• www.wixapis.com — content and form submissions
• edge.wixapis.com — the newsroom
• static.wixstatic.com — images uploaded through the CMS

These are enumerated in the policy's connect-src and img-src, and the build fails if a page reaches for a host its own policy does not name. Content and form submissions are exchanged with those hosts from the browser, using an anonymous token this site's public client id can obtain — there is no server of ours in that path, and nothing in it identifies a visitor.

Each page's connect-src is derived from what that page actually does — the CMS binder it runs, whether it wires the cart, whether it carries a form — so a page that does none of these, this one included, names no host but its own origin in connect-src.

What we collect

The site's forms — contact, careers and mission enquiries — collect the name, organisation, email address and message a visitor types, and nothing else. There is no analytics script, no advertising pixel and no fingerprinting. Submissions go to Wix Forms and are read by staff.

This repository sets no cookies. The hosting platform does: every response carries a sec-fetch-unsupported flag, and Wix's commerce routes set a session cookie of their own. Neither is ours to set or remove. What the site itself stores is one thing — on the shop pages, an anonymous Wix visitor token in localStorage so a cart survives navigation between pages. It identifies a cart, not a person.

What we do not control

Wix serves three things on this hostname that this repository does not produce. They are stock behaviour of the hosting platform rather than anything configured here, and a scan of this domain will find them, so they are named:

• /_api/* — Wix's platform endpoints. Some answer unauthenticated with an anonymous visitor id and per-app tokens, and set a Wix session cookie. The tokens are the anonymous ones any caller can already mint from Wix's public OAuth endpoint using this site's public client id; they carry no account, because there are no accounts.
• /__ecom/checkout — Wix's hosted checkout, where the shop's Checkout button goes. It is Wix's page, not ours: it carries none of the policy described above and loads Wix's own front-end code from Wix's CDNs. If your policy has to cover a purchase journey, that page is the one to assess, and it is Wix's to answer for.
• The error page for any path this site does not publish, which is likewise Wix's and carries no policy of ours.

We would rather state this than have it read as a contradiction of the sections above. Those sections are about our pages, and they are enforced. This one is the honest limit of what they cover.

Transport

HTTPS only. The hosting platform sets HSTS and X-Content-Type-Options: nosniff; those are the platform's to set and not something this repository controls, so treat them as observed rather than guaranteed by us. It sets no X-Frame-Options, and a <meta> policy cannot supply frame-ancestors, so there is nothing on this origin that prevents framing. We would set it if the platform let us.

Reporting a problem

Email security@blackstarorbital.com. We read it, we will confirm receipt, and we will not threaten you for telling us. If you are a security team assessing this domain for access on a corporate network and need something not covered here, the same address reaches an engineer.