How this website is secured
This page describes the security controls on this website, every one of which can be checked from outside. It covers the website only. The security of systems we build for clients is defined, tested and documented per engagement, and we are glad to walk you through that on a call.
Last reviewed 13 September 2026.
Encryption and response headers
Every page is served over HTTPS from Cloudflare’s edge network, and every response carries the following headers. You can confirm each one yourself with your browser’s developer tools or a command-line HTTP client.
- Strict-Transport-Security
- Browsers are told to use HTTPS for this site for one year, so a downgraded plain-HTTP connection is refused.
- Content-Security-Policy
- Scripts and styles may load only from this domain. Plugins are blocked, the page may not be framed by other sites, and insecure requests are upgraded.
- X-Frame-Options
- The site cannot be embedded in a frame on another origin, which closes off clickjacking.
- Referrer-Policy
- When you follow a link away from this site, the full URL you came from is not passed to the destination.
- Permissions-Policy
- Camera, microphone, geolocation, payment, USB and motion sensors are disabled for every page. This site has no reason to ask for any of them.
What happens to a message you send us
The contact form is validated in your browser for convenience and then validated again on our server, which is the check that counts. The server-side handler never ships to the browser, so the credentials it uses to send email are not present anywhere in the code your browser downloads.
Submissions are checked against a hidden honeypot field to discard automated spam, and repeated identical submissions are suppressed. Your message is delivered through our own Microsoft 365 tenant to info@fictivebox.com; no separate email marketing or delivery vendor receives its contents. If delivery fails, the form tells you so and asks you to email us directly rather than reporting a success it cannot confirm.
This website sets no cookies and runs no third-party scripts. The content security policy above enforces that at the browser level. See the Cookie Policy and Privacy Policy.
How the code that builds this site is reviewed
The website is built and deployed by an automated pipeline, and that pipeline treats dependency risk as a blocking condition rather than a warning:
- Dependencies are installed from a locked manifest, so a build always uses the exact versions that were reviewed.
- Every build runs a vulnerability audit of those dependencies. A high or critical finding fails the build; the site is not deployed until it is resolved.
- Changes that alter dependencies are put through an additional dependency review before they can be merged.
- Every build produces a software bill of materials in CycloneDX format, so the exact set of components in any deployed version is recorded.
- Third-party build actions used by the pipeline are pinned to specific commits rather than to floating version tags, so an upstream action cannot change underneath us without a deliberate update.
What we engineer to, and what we do not claim
In client work we design and build systems to the requirements of SOC 2, ISO 27001, GDPR, HIPAA and TS 50701, where the engagement calls for it. Those are statements about how we build. They are not claims that FictiveBox Digital holds a certificate or attestation under any of those frameworks, and this page makes no such claim.
We would rather publish fewer credentials and have every one of them checkable than list badges we cannot back with a certificate number and a registrar. If you need a specific attestation for a procurement process, ask us and we will tell you exactly what we can and cannot provide.
If you find something
If you believe you have found a security issue in this website, we want to hear about it. Email info@fictivebox.com with enough detail for us to reproduce it. This address is also published in the machine-readable security.txt file at the standard location, so automated tooling can find it.
We will acknowledge your report, investigate it, and keep you informed of what we find and what we change. We ask that you give us a reasonable opportunity to fix an issue before disclosing it publicly, that you do not access or alter data that is not yours, and that you do not degrade the service for other visitors while testing. Acting in good faith within those limits, you will not face legal action from us for your research.
We do not currently run a paid bug bounty programme. We will credit researchers who report a valid issue, with their permission, once it is resolved.