We hold our own website to the standard we recommend.

How this site is built

• No runtime to attack. Pages are generated at build time and served as static files. There is no content management system, no database, no plugins and no administrative login on this domain.
• No client-side JavaScript, no forms. The site works with scripts disabled and accepts no input; contact is by email.
• Strict transport and content policies. HTTPS only with HSTS preload, a Content Security Policy that allows only same-origin resources, frame embedding denied, referrer and permissions policies locked down.
• No tracking. No third-party scripts, fonts, analytics or cookies.
• Supply chain controls. Dependencies are pinned, audited on every build and updated through reviewed pull requests. Builds run on a patched Node.js LTS release.

Reporting a vulnerability

If you believe you have found a security issue in this website or any RIZQ-operated service, email security@rizq.tech. Please include steps to reproduce. We acknowledge reports within two business days and will not pursue action against good-faith research that avoids privacy violations, data destruction and service disruption. Our machine-readable policy is at /.well-known/security.txt.