Two distinct boundaries.

This website

• Static files only: no server runtime, no database, no forms, no secrets, no telemetry.
• Strict CSP delivered as build-generated meta policy — no unsafe-inline or unsafe-eval; the single narrow exception is 'wasm-unsafe-eval' for same-origin search (Pagefind).
• Response headers on every route: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin.
• Same-origin resources by default; normal page loads make no provider, GitHub, or analytics requests.
• Proprietary site source; see the LICENSE and the repository SECURITY.md.

The Babel product

• Babel Harness is a separate repository with its own documentation, license, and security posture.
• It is local software; you configure providers and execution policy yourself. Local execution does not mean local model inference, and provider-backed runs send project content to your configured provider.
• Execution isolation (Docker sandbox, fail-closed profiles) is a product boundary — see execution profiles.
• No compliance certification (SOC 2, ISO, or similar) is claimed for the product or this site.

Reporting

For this website, useGitHub private vulnerability reportingif available, or contact the repository owner through the public profile. Do not open public issues with exploit details.

Concerns about the Babel product belong to theBabel repository.