Security

The short version

Credit Defense Hub is a static website — a set of pre-built HTML pages served from a web host, with no visitor accounts, no login, and no database that stores anything about you. Our calculators and debt tracker run entirely in your browser. There is nothing for an attacker to steal from a server, because your personal inputs never leave your device.

A static export, not a live application

The production build of this Site is a static export. Every page is built ahead of time into plain files. No application server runs behind the live site.

Our build pipeline enforces that on purpose. Before we package the production bundle, it deletes the code that would need a live server to run — the API routes and the internal admin review-moderation tool are stripped out entirely (rm -rf src/app/api src/app/admin in our static-export build script). The build also refuses to finish if it finds a leftover private data folder. The result: the live site has no admin panel and no API endpoints to attack, because we never ship them there.

Security headers we enforce

Every page on this Site carries the same set of browser security headers. That’s true on our Node-hosted preview and on the production static host, which mirrors the same header list through server configuration (a static host can’t run our application code directly):

• Content-Security-Policy — restricts which domains this Site’s pages are allowed to load scripts, styles, images, and fonts from, which limits the damage a successful injection attack could do.
• Strict-Transport-Security — tells your browser to only ever reach this Site over HTTPS, never plain HTTP, for the next two years.
• X-Content-Type-Options: nosniff — stops browsers from guessing a file’s type in a way that could turn an image or data file into executable script.
• X-Frame-Options: SAMEORIGIN — stops other sites from embedding this Site in a hidden frame (clickjacking).
• Referrer-Policy: strict-origin-when-cross-origin — limits how much of the URL you were on gets shared when you click a link off this Site.
• Permissions-Policy — turns off browser access to your camera, microphone, location, and payment APIs for every page on this Site, since we never need any of them.
• Cross-Origin-Opener-Policy: same-origin — isolates this Site’s browser tab from other sites for an extra layer of process separation.

We also force every visit to HTTPS and redirect any plain-HTTP request before it’s served, and we route the domain to a single canonical host so there’s only ever one address search engines and browsers treat as authoritative.

Calculators and the debt tracker: your browser only

Every calculator on this Site runs on plain arithmetic in your browser. Nothing you type into a payoff calculator or interest-cost tool is ever sent anywhere. The debt tracker works the same way: it saves what you enter to your own browser’s localStorage, under the key cdh-debt-tracker-v1. That storage area lives only on your device. No other website can read it, and no server of ours ever sees it. Clear your browser data and it’s gone for good — we never had a copy to begin with.

Analytics, if enabled

We use an optional analytics setup, built to collect as little as possible. It loads only when a measurement ID is configured for a given deployment. It tracks page views and a short list of named events, like “calculator used” or “template copied.” It is coded to never include personal information or form contents in what it sends. The Site works fully with analytics turned off. For details on cookies and what any analytics or advertising partner may collect, see our Privacy Policy.

What we don’t claim

We won’t tell you this Site uses “bank-level encryption,” holds a security certification, or has passed a third-party audit. None of that is true today, and we won’t invent it to sound more reassuring. What’s above is the complete, accurate list of what protects you here: a small attack surface, enforced browser headers, forced HTTPS, and tools built to keep your data on your own device.

Report a security issue

If you find a real vulnerability — not a broken link or a typo, but an actual security weakness — please don’t post it publicly first. Read our Vulnerability Disclosure Program for scope, safe-harbor terms, and how to report it.