Security
Protecting this place of remembrance.
How we care for the security of Celerina’s memorial, protect the words you share, and handle concerns about the site.
Protection in your browser
The memorial uses HTTPS to protect information in transit. Our pages also send HTTP Strict Transport Security instructions so supported browsers continue using secure connections on future visits.
A Content Security Policy limits where scripts and other resources can load from. Inline scripts use a fresh, unpredictable permission value for each page request. Additional browser headers prevent other sites from framing our pages, disable unnecessary camera, microphone, and location permissions, and limit the information sent when you follow a link to another site.
Careful handling of requests
We check server-function request sizes and data structures before the framework decodes them. The server then validates submitted fields, including their types, lengths, and permitted values. These checks apply even when someone bypasses the form in their browser.
Database queries bind visitor input as values, keeping it separate from SQL commands. Remembrances are displayed as text, with HTML characters escaped by React. Request origin checks help prevent other websites from submitting requests through a visitor’s browser without their intent.
Safer remembrances
The remembrance form combines submission rate limits, an automated spam check, and Cloudflare Turnstile verification. The server verifies Turnstile responses, including the expected site and action, before sending a remembrance for moderation.
Only approved remembrances appear publicly. An automated safety review checks each eligible submission; uncertain results and moderation-service failures are held for family review. Submissions rejected by that review are not saved to the memorial’s database. Visitors must agree to publication before submitting.
Data and access
You do not need an account to visit, and the site does not collect passwords or payment details. Service credentials stay on the server, outside the code sent to your browser. Administrative moderation uses authenticated operator tools; there is no public administration form or moderation endpoint.
We use Cloudflare to run the site and verify submissions, and TypeSafe to help review remembrances. The privacy policy explains what information these services receive, how it is used, and how to ask about your personal information.
Photographs and caching
Photo requests are checked against the memorial’s photo index and permitted image sizes. Visitors cannot choose arbitrary storage paths. The photographs published here are intentionally public and may be downloaded under our terms of use.
Public photographs can be cached for faster viewing. Pages that include your theme preference and remembrance-list responses use instructions that prevent shared caching, keeping visitor preferences separate and remembrance lists fresh.
Checks as the site changes
Our development checks include type checking, code analysis, production builds, and targeted checks for request validation, origin restrictions, moderation behavior, and image delivery. We keep dependency versions recorded in a lockfile so changes can be reviewed and reproduced.
These protections reflect established practices described in OWASP guidance on input validation, Content Security Policy, and cross-site request forgery prevention. We use several layers of protection because any one check has limits.
Report a security concern
If you find a possible security issue, please contact Mark Anthony Llego at Edventure Web Development Services privately at support@edventure.com.ph. Include the affected page, what happened, the steps needed to reproduce it, and the possible impact. A small example with personal information removed is helpful.
Please avoid tests that disrupt the memorial, change its content, or access other people’s information. If you encounter private information, stop testing and describe the exposure without copying it into your report. Share the details privately so we can investigate and address the issue.