An official website of ByteWish Foundation, a 501(c)(3) private foundation Here's how you know
Registered with the IRS

Our EIN is 99‑0566992. Look us up in the IRS Tax Exempt Organization Search.

Secure connection

The https address means your visit to bytewish.work is encrypted.

ByteWish Foundation

Security, taken personally.

No site is beyond mistakes, including this one. Here is exactly how to reach us about a security problem, and what this site already does to defend itself.

Report a vulnerability

A person reads every report. Please give us a reasonable chance to fix an issue before you publish it, and tell us how you would like to be credited.

Where to send it

What helps us fix it fast

  • The page or endpoint involved
  • Steps to reproduce what you found
  • What you believe the impact is
  • Screenshots or proof-of-concept details if you have them

Reports about the app at app.bytewish.work are welcome at the same address.

How this site defends itself

Everything below is verifiable in the page source and the public repository, and a security scan re-checks it before every change ships.

Minimal attack surface by design

  • Static files only: no server code, no database, and no accounts
  • The one mailing-list form posts only to our own application, and sets no cookies
  • Pages load zero third-party requests: every font, style, script, and image comes from bytewish.work

Hardening on every page

  • A strict Content-Security-Policy that starts from default-src 'none' and allows only same-origin assets, plus the mailing-list page's post to our own app
  • External links that open in a new tab carry rel="noopener"
  • HTTPS everywhere, with a strict referrer policy

Scanned before every change

The test suite refuses to pass unless the Content-Security-Policy is present and exact on every page, every page loads with zero policy violations in a real browser, link hygiene holds, security.txt is current, and the project's dependencies clear an audit for known high-severity vulnerabilities.

On top of that, every push and pull request runs a full OWASP ZAP scan against the site in continuous integration, and a scheduled scan runs weekly. The build fails on any new medium or high finding.