# Security policy — HBF Research Preview 1.0

## Scope

This archive is a static scientific website. Scientific calculations execute locally in browser workers. The canonical scientific surface does not request wallet access, trading activity, token purchase, credentials, or partner data uploads.

## Browser controls

- canonical science directories enforce CSP and block framing;
- object embedding and form submission to other origins are disabled;
- referrer and MIME-sniffing controls are set;
- WebGL/Three.js assets are vendor-first;
- Pyodide is pinned to 0.26.4, probes `/assets/pyodide/` first, and otherwise uses the identical jsDelivr version;
- static pages remain readable if the optional runtime fails;
- no service secret, API key, private dataset, or environment file is included.

## Known security/supply-chain gate

The Pyodide binary distribution is not included. Hosts requiring a self-only policy must run the supplied vendoring procedure in a controlled build, verify upstream hashes, upload `/assets/pyodide/`, remove the jsDelivr origin from CSP, and rerun the release tests. Until then the fallback is explicit rather than hidden.

## Reporting

Before deployment, replace this section with a monitored project security contact and response SLA. Do not publish an unmonitored email address. For a hosted deployment, preserve the affected URL, release hash, browser/version, minimal reproduction, and security impact. Do not include private or sensitive data in a public issue.

## Unsupported claims

Passing these static controls does not establish OWASP ASVS certification, penetration-test completion, or supply-chain attestation by a third party.