NEBULA is a fully static site (no server, no database, no user accounts), so its attack surface is minimal. Still, we take reports seriously.

Reporting a vulnerability: if you find a security issue (e.g., a compromised hot-linked asset, an XSS vector in a demo, a malicious link), please open a GitHub issue — or, for sensitive reports, use GitHub's "Report a vulnerability" (Security tab → Private vulnerability reporting).

Scope: the gallery site, design demos, DESIGN.md specs, and the nebula-engine skill.

Response: we aim to acknowledge reports within 72 hours and ship a fix as fast as a static site allows (usually the same day).

Hardening in place:

• Fully static: no server code, no database, no accounts, no forms, no cookies, no analytics, zero JS dependencies.
• Every page ships a Content-Security-Policy (default-src 'none' + explicit allow-list), object-src 'none', base-uri 'none', form-action 'none'.
• Demo imagery is self-hosted in this repository — no third-party image CDNs at runtime in the demos.
• External links use rel="noopener"; clipboard runs only in secure contexts.
• Hosting (GitHub Pages) sits behind a global CDN, which absorbs volumetric DDoS traffic; a static site also has no expensive endpoints to exhaust.
• The dev server (dev-server.py) binds to 127.0.0.1 only, refuses dotfile paths (.git etc.) and sends X-Content-Type-Options: nosniff.

NEBULA — to'liq statik sayt (server yo'q, baza yo'q, akkauntlar yo'q), shuning uchun hujum yuzasi minimal. Shunga qaramay, xabarlarga jiddiy qaraymiz.

Zaiflik haqida xabar berish: xavfsizlik muammosi topsangiz (masalan, buzilgan tashqi resurs, demodagi XSS, zararli link) — GitHub'da issue oching. Maxfiy xabarlar uchun GitHub'ning "Report a vulnerability" funksiyasidan foydalaning (Security bo'limi → Private vulnerability reporting).

Qamrov: galereya sayti, dizayn demolari, DESIGN.md spec'lar va nebula-engine skill.

Javob: xabarni 72 soat ichida tasdiqlashga va tuzatishni imkon qadar tez (odatda o'sha kuni) chiqarishga harakat qilamiz.

Qo'llangan himoya choralari:

• To'liq statik: server kodi yo'q, baza yo'q, akkaunt yo'q, forma yo'q, cookie yo'q, analitika yo'q, JS bog'liqliklari nol.
• Har bir sahifada Content-Security-Policy (default-src 'none' + aniq ruxsat ro'yxati), object-src 'none', base-uri 'none', form-action 'none'.
• Demo rasmlari shu repoda self-host qilingan — demolarda uchinchi tomon rasm-CDN'lari ishlatilmaydi.
• Tashqi linklar rel="noopener" bilan; clipboard faqat xavfsiz kontekstda ishlaydi.
• Hosting (GitHub Pages) global CDN ortida — hajmiy DDoS trafigini CDN yutadi; statik saytda "charchatadigan" qimmat endpointlar ham yo'q.
• Dev server (dev-server.py) faqat 127.0.0.1ga ulanadi, nuqtali yo'llarni (.git va b.) rad etadi va X-Content-Type-Options: nosniff yuboradi.