Security dossier / evidence only
Security practices
This page describes what the project can honestly claim today. It does not invent encryption-at-rest, zero-knowledge architecture, warrant canaries, or live secure intake channels.
Last reviewed
Claims trimmed to repository-visible behavior.
Secure intake
No verified tip channel is live.
Independent audit
Do not assume pen-test coverage.
Threat context we design against
Readers may face commercial tracking, workplace scrutiny, police interest, or hostile private actors. Guidance on this site prioritizes practical privacy and organizing hygiene. It is not a guarantee of anonymity or safety.
Security evidence ledger
| Control | Status | Evidence / note |
|---|---|---|
| Transport encryption | Intended | TLS is expected in production reverse-proxy configuration; exact cipher and HSTS details depend on the live nginx/TLS setup. |
| Client analytics | Not shipped | No first-party analytics, advertising pixels, or fingerprinting scripts are part of the public app code. |
| Account system | Not present | This site does not create accounts or store visitor identities for participation or tips. |
| Sensitive intake | Coming soon | SecureDrop, PGP, and Signal destinations are not configured. See /secure-contact. |
| Independent audit | Not claimed | No verified third-party penetration-test or audit report is published for this project. |
What visitors can do now
- Prefer hardened browsers and compartmentalized accounts when reading organizing material.
- Treat category labels on Resistance Wire as feed metadata, not verification.
- Use the local participation planner at /join — nothing is transmitted.
- Check /secure-contact for channel status. Intake is coming soon.
Vulnerability reports
A dedicated security intake channel is coming soon. Until then, do not assume this site can receive encrypted vulnerability reports. Prefer established disclosure paths for affected upstream projects when relevant.
Related guidance
- Use Tor Browser — For stronger anonymity when reading sensitive guides
- Review privacy hub — Practical hardening by topic and threat level
- Threat model quiz — Browser-local assessment that stays on your device
- EFF SSD — Trusted external self-defense guidance