Website security

Effective November 11, 2026.

Controls implemented in this build

• HTTPS responses request continued HTTPS use through HSTS.
• A Content Security Policy restricts scripts and connections to this site, disables embedded objects and limits framing to the site and its ChatGPT review host.
• Browser permissions for camera, microphone, location, payment and USB are disabled.
• Administration and private inquiry endpoints require an authorized identity; private responses are not cached.
• State-changing endpoints reject mismatched origins and cross-site browser requests.
• Inquiry validation, a spam honeypot, request-size limits and a per-network inquiry limit reduce abuse.
• Database parameters separate inquiry values from SQL. User content is escaped before insertion into public page markup.
• On the GoDaddy build, passwords are hashed with scrypt and administrator sessions use HttpOnly, Secure and SameSite cookies. Login attempts are rate-limited.

What this does not claim

These controls are not a certification, a guarantee against attacks, or evidence that a paid firewall, malware scanner, multi-factor authentication, independent penetration test, backup schedule or breach-monitoring service is active. Provider-managed protection and the business's internal practices must be verified separately. This page applies to the deployed build you are viewing; a review-copy change does not update another host automatically.

Report a concern

Email ocruz@chromeeng.com with the affected address and a brief description. Do not include credentials, personal records or exploit data containing other people's information. Do not access or modify data that is not yours. This is a reporting contact, not a bug-bounty offer.