---
title: "Security Center"
description: "The site's security posture, XP-style: firewall, updates, threat protection."
path: "/security"
section: "status"
kind: "page"
source: "https://aadhar.sh/security"
---

> Site index: https://aadhar.sh/llms.txt
> This is the Markdown twin of a page on aadhar.sh. The HTML at the source
> URL below is the original, and is hand-written and unminified on purpose.

# Security Center

Windows used to greet you with three green shields. This is the honest version
for aadhar.sh: what actually guards the site, and what each layer really does.

Three values on the live page come from your own connection (the Cloudflare colo
that answered, the HTTP version, the TLS version), so they are not published
here. <https://aadhar.sh/whoareyou.json> returns those for your request as JSON.

## Firewall: the Cloudflare edge

Every request hits Cloudflare's network before it reaches the origin, so the
edge filters traffic, terminates TLS, and absorbs DDoS attempts before they get
near me.

## Automatic Updates: deploy-time delivery

Every deploy purges the edge, shared assets carry short revalidating caches, and
pages ship origin-fresh, so a return visit picks up changes without a hard
reload and there is no second cache to go stale. A service worker used to do
this job; it retired in v136 because the platform now covers it. The recent
installs are listed at <https://aadhar.sh/updates>.

## Threat and identity protection: bot management and Web Bot Auth

Cloudflare scores incoming bots. This site signs its *own* crawler's outbound
requests per RFC 9421 and publishes the key at
`/.well-known/http-message-signatures-directory`, so a site receiving a request
from AadharshBot can verify it really came from here. See
<https://aadhar.sh/bot.md> for the full crawler contract.

## Header and transport details

- **Content-Security-Policy**: `default-src 'self'; object-src 'none';
  frame-ancestors 'none'; upgrade-insecure-requests`. No external script or
  connect origin: the browser-facing directives are self-only. Server-side
  route handlers may still make the outbound calls documented on their own
  surfaces.
- **script-src**: every page built here ships a sha256 of each of its own inline
  scripts, so the enforced policy names each inline script by hash instead of
  trusting inline code as a class. `'unsafe-inline'` is gone from this directive
  as of 2026-08-16; it rode along in a report-only twin for the two weeks it took
  to prove itself against real browsers. The style directive keeps
  `'unsafe-inline'` and will, because the CSS here is inline by design, so this is
  protection against script injection and not against style injection.
- **... and what it lets through**: hashing inline scripts says nothing about
  scripts loaded by `src` from this origin, which `'self'` permits. That was not
  hypothetical here: from 2026-08-06 the edge injected `/.webmcp/bridge.js` into
  every page after this worker was done, so the strictest policy the site could
  ship still admitted 47KB of code the repository does not contain. That injection
  is off, and every `src` this page loads is now a file in the repository. The
  directive still permits any same-origin script, so what closed the gap was
  removing the script rather than tightening the policy, and the next edge feature
  anybody enables re-opens it silently. Named rather than buried, because a page
  about guarantees should say where they stop; details at
  <https://aadhar.sh/whoareyou.md>.
- **Permissions-Policy**: camera, microphone, geolocation, USB, Topics and 10
  more, all denied.
- **X-Frame-Options**: `DENY`.
- **X-Content-Type-Options**: `nosniff`.
- **Referrer-Policy**: `strict-origin-when-cross-origin`.
- **DNSSEC**: signed (ECDSAP256SHA256, DS at the registrar).
- **Content Signals**: search, ai-input, ai-train, all yes, deliberately open.

Read-only, nothing logged or stored. <https://aadhar.sh/whoareyou.md> covers
what your specific request revealed.

Source: https://aadhar.sh/security