Security

What this site loads, and from where

blackstarorbital.com is a static site. It has no server-side application, no database, no user accounts and no login. Every page is a file; the only code that runs is JavaScript served from this domain.

All executable code is same-origin

No page loads a script from a third party. The Wix SDK the site uses for content and forms is vendored into this repository at pinned versions, published from /assets/sdk/, and verified byte for byte against a recorded hash on every build. A build in which any import points off this origin fails and is never published.

Content-Security-Policy

Every page declares a policy. script-src is 'self' plus an explicit SHA-256 hash for each inline script — there is no 'unsafe-inline', so script injected into a page does not execute. The hashes are generated at build time and the build fails if any inline script is not covered by one.

The policy is delivered as a <meta> element because the hosting platform does not expose response headers to us. That has one consequence worth stating plainly: frame-ancestors and HSTS cannot be set in a meta policy, so this page does not claim them.

Outbound connections

A visitor's browser contacts exactly three hosts besides this one, all Wix, all first-party to the platform that hosts the site:

• www.wixapis.com — content and form submissions
• edge.wixapis.com — the newsroom
• static.wixstatic.com — images uploaded through the CMS

These are enumerated in the policy's connect-src and img-src. Nothing else is permitted.

What we collect

The site's forms — contact, careers and mission enquiries — collect the name, organisation, email address and message a visitor types, and nothing else. There is no analytics script, no advertising pixel and no fingerprinting. Submissions go to Wix Forms and are read by staff.

The site sets no cookies. It does store one thing locally: on the shop pages, an anonymous Wix visitor token is kept in localStorage so a cart survives navigation between pages. It identifies a cart, not a person, and it is not read anywhere else on the site.

Transport

HTTPS only. The hosting platform sets HSTS and X-Content-Type-Options: nosniff; those are the platform's to set and not something this repository controls, so treat them as observed rather than guaranteed by us.

Reporting a problem

Email security@blackstarorbital.com. We read it, we will confirm receipt, and we will not threaten you for telling us. If you are a security team assessing this domain for access on a corporate network and need something not covered here, the same address reaches an engineer.