No. I
The quiet half of every conversation.
Chapter I
What leaves this host
Three kinds of file, all static, all built from our own source. Nothing here is generated per visitor, and nothing is fetched from another vendor to assemble it.
/widget.js- The bundle your page embeds, styles included. Cached five minutes, so a fix reaches your visitors the same afternoon.
/fonts/- Manrope for the widget, Playfair Display and IBM Plex Mono for this page. Subset to Latin and Latin Extended‑A, so magyar renders without a fallback. Cached for a year.
/.well-known/security.txt- Where to write if you find something broken. See chapter III.
Chapter II
What never does
A delivery host that also holds secrets is two problems wearing one certificate. This one holds none.
-
i
No accounts. Signing in, billing and every dashboard live on kodachat.com. Nothing here can log you in.
-
ii
No API. Conversations are handled by
kodachat.com. This host answersGET,HEADandOPTIONS; everything else gets a 405. -
iii
No visitor data. No cookie is set, no identifier is issued, no analytics script is bundled. This host keeps no access log of its own.
-
iv
One intermediary, named. Cloudflare fronts this host as a CDN proxy and terminates TLS, so it sees request metadata and appends its own network-error reporting header. Beyond that there are no third parties: every byte served here is built from our own source, and the page you are reading loads nothing from anywhere else.
Chapter III
Found a flaw? Tell us first.
Write to us before you write about it, and we will keep you posted while we fix it. Testing in good faith against this host — no denial of service, no traffic from other people's browsers, no data you were not given — will not be met with a lawyer.
- Write to
- security@kodachat.com
- In
- English or magyarul
- Reply by
- Three working days, with a name attached
- Disclosure
- Coordinated, 90 days by default, credit if you want it
Chapter IV
What every response carries
Published so you can check us against it. If a response reaches you without one of these, that is a bug worth chapter III.
| Header | Value | Reason |
|---|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | Two years of HTTPS only, preloaded, so the first request is never plaintext. |
| Content-Security-Policy | default-src 'none'; script-src 'self'; frame-ancestors 'none' | Every byte on this page comes from this host. Nothing is framed, nothing is fetched elsewhere. |
| X-Content-Type-Options | nosniff | A stylesheet is never guessed into a script. |
| Referrer-Policy | strict-origin-when-cross-origin | Your customers' URLs stay with you. |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=() | Nothing here needs a sensor, so nothing here may ask. |
| Cross-Origin-Resource-Policy | cross-origin | Assets are meant to be embedded by your site — deliberately, not by omission. |
| Cross-Origin-Opener-Policy | same-origin | No other document keeps a handle on this window. |