Security policy

Everything travels encrypted

The whole site is served over HTTPS, and so is the form. What you type goes encrypted to this same domain: it does not pass through any third-party form service, and the message is delivered by authenticated SMTP with a signature (DKIM) so that the receiving mailbox can verify it really came from here.

The recipient is fixed in the code

This is the part worth explaining, because it is the classic way a small site gets abused. The address your message goes to is written into the program, and it is never read from the request. A form that accepted its destination from the outside would turn this domain into a spam relay within a week — with Justin’s name on it.

Anything that ends up in the headers of that email has its line breaks and control characters stripped, in two separate layers, and the check fails closed: malformed text is rejected rather than passed through and hoped for.

What is deliberately not here

Most of the security of a site like this comes from what it does not do:

• No accounts, no passwords, no sessions. There is no login to break into and no password of yours stored anywhere.
• No database. Your message is an email, not a row in a table waiting to be dumped.
• No file uploads and no payments: no checkout, no card form, no payment processor.
• No advertising trackers. The only measuring tool is Google Analytics, on the home page and the articles, and it never receives what you type — see the cookie policy.
• Nothing you type is ever printed back into a page. That is what makes the most common web attack (XSS) impossible here, and it was tested by sending one.

Only your browser gets instructions from us

Every page carries a content security policy: a list telling your browser exactly which code it is allowed to run and where images and frames may come from. Anything outside that list does not execute — including, if it ever happened, something injected by somebody else. The pages that need no JavaScript are locked down harder than the ones that do.

The list only names Google on the pages that count visits. The legal pages, which count nothing, are not allowed to load anything from outside this domain.

Against robots and floods

The form counts how many messages have been sent from the same connection: at most a few in five minutes and twelve in an hour, plus a ceiling for the whole site so that nobody can fill the mailbox by spreading the load across many addresses. To count, it stores a one-way fingerprint of your IP and not the address itself, and it expires by itself after an hour.

If you ever hit that limit by accident, the message tells you how many minutes are left and offers WhatsApp, which the limit cannot block. Nobody should lose a lesson to an anti-spam rule.

The limitations, declared

This is the section that most security pages do not have.

• This is a shared hosting account, not a private server. The security of the machine underneath is the hosting provider’s, not something this site controls.
• Some browser protections can only be sent as real HTTP headers, and the static pages here cannot yet send all of them. It is being worked on and it is written down rather than glossed over.
• Email is email. A message that leaves this site correctly signed can still land in a spam folder, and no site can promise otherwise. If you write and get no answer within a day, check your spam folder and then use WhatsApp.

Found a problem? This is how to tell us

Write to contact@estudioabrahampiano.com with the subject SECURITY and say what you found and how to reproduce it. There is no bug bounty — this is a piano teacher’s website — but a real report gets a human answer and gets fixed, and you get the credit if you want it.

What is asked in return is the usual: do not run anything that degrades the service for the students using it, do not read or alter data that is not yours, and give us a reasonable window before publishing. This same address is published in machine-readable form at /.well-known/security.txt.