Security by design. Defensible engineering.
At Granwel, security is not a marketing veneer. It is an architectural discipline governed by strict attack surface minimization, cryptographic verification, and a transparent responsible disclosure process.
Static-First Attack Surface Elimination
The most secure server is no server at all. Granwel’s public web infrastructure is engineered to completely remove entire classes of web vulnerabilities.
Zero Server Execution
All pages are compiled to pure immutable static HTML at build time. No Node/PHP runtime processes user input on production web edges.
No SQL/NoSQL Surface
There are zero production databases, query interfaces, or ORMs connected to the corporate website. Injection attacks are structurally impossible.
No Public Auth Endpoints
There is no /wp-admin or login portal. Deployment is governed solely through cryptographic Git commit signatures and isolated CI.
Zero Third-Party JS
No Google Tag Manager, Facebook Pixels, Hotjar, or foreign CDNs. Scripts and fonts are strictly local and covered by a strict Content Security Policy.
Production Security Headers
Every HTTP response from granwel.com includes a hardened header suite to enforce transport security, isolate origins, and prevent clickjacking.
| Header | Configured Value | Protective Function |
|---|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | Enforces TLS/HTTPS strictly for 2 years with HSTS preload. |
| Content-Security-Policy | default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data:; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; | Restricts all resources to first-party origins; forbids external injection. |
| X-Content-Type-Options | nosniff | Prevents MIME-sniffing execution attacks. |
| X-Frame-Options | DENY | Blocks all iframe embedding to eliminate UI clickjacking. |
| Referrer-Policy | strict-origin-when-cross-origin | Protects visitor privacy during outbound navigation. |
| Permissions-Policy | accelerometer=(), camera=(), geolocation=(), microphone=(), payment=(), usb=() | Explicitly disables all intrusive browser sensor APIs. |
Responsible Security Disclosure Policy
Granwel welcomes responsible disclosure of security vulnerabilities from independent researchers, security professionals, and our community. We are committed to working constructively with researchers who adhere to coordinated disclosure guidelines.
All web properties under granwel.com, official Granwel repositories, and AEGIS / ATTICUS preview kernels. Unrelated third-party infrastructure is strictly out of scope.
If you conduct vulnerability research in good faith and avoid privacy violations, data destruction, service degradation, or social engineering, Granwel will not pursue legal action against you.
Our security engineering team will acknowledge initial reports within 48 business hours, provide regular triage updates, and coordinate remediation prior to any public disclosure.