LimeByte

01Transparency

Security of this website.

We build security in from the start – here too. This page explains how limebyte.de is built and delivered, and how you can verify it yourself.

02Implemented

What we have implemented

  1. Static pages

    Every page is generated in advance as finished HTML. There is no database and no CMS login that could be attacked.

  2. No third-party requests

    Fonts, images and scripts live on our own server. Visiting this website never connects you to Google, social networks or any other third party. Only the contact form loads the spam check by Cloudflare.

  3. No cookies, no tracking

    We use no cookies and no analytics services. Our own server counts rough page statistics, without IP addresses and without any script in your browser. That is why we don't need a cookie banner.

  4. Strict security headers

    A content security policy allows scripts and styles from this domain only, without unsafe-inline and unsafe-eval; the single exception is the form's spam check at Cloudflare. Plus HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and protection against framing by other sites.

  5. Data-minimal contact form

    The form only asks for what we need to process your request. Cloudflare Turnstile checks whether a submission comes from a person – and only loads once you start filling in the form.

Third-party requests
0
Cookies
0
Home page, transferred (mobile, fully scrolled)
254.6 KiB
JavaScript
4.6 KiB
Measured on
25 September 2026
For your IT team: show the raw security headers

The server sends these lines with every response. Your IT team can compare them with its own requirements.

  • Content-Security-Policy: default-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; font-src 'self'; connect-src 'self'; manifest-src 'self'; media-src 'self'; object-src 'none'
  • Cross-Origin-Opener-Policy: same-origin
  • Cross-Origin-Resource-Policy: same-origin
  • Permissions-Policy: accelerometer=(), autoplay=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), interest-cohort=(), microphone=(), payment=(), usb=()
  • Referrer-Policy: strict-origin-when-cross-origin
  • Strict-Transport-Security: max-age=31536000
  • X-Content-Type-Options: nosniff
  • X-Frame-Options: DENY

03Verify

Check it yourself

You can see the security headers with a single terminal command or in your browser's developer tools (Network tab). Independent scanners such as Mozilla's HTTP Observatory rate them publicly.

curl -I https://limebyte.de/

Open Mozilla HTTP Observatory

04Report

Found a vulnerability?

If you discover a security vulnerability on this website or in our systems, please contact us confidentially. We will reply, investigate and fix confirmed issues. Please don't publish details before we have spoken.

info@limebyte.de

Machine-readable: /.well-known/security.txt

Privacy policy