Security
Security is part of Beacon's mission, not an afterthought.
Beacon helps nonprofits build technology that is safe, resilient, and maintainable — see Security first in our technology philosophy. We hold this website to the same standard.
How this website is built
Server-side validation
Every form field is validated and length-limited on the server, not just in the browser.
Parameterized queries
All database writes use parameterized statements. Form input is never concatenated into SQL.
Bot & spam defenses
A hidden honeypot field, timing checks, and optional Cloudflare Turnstile reduce automated abuse without adding friction for real visitors.
Rate limiting
Submission velocity is checked server-side, in addition to edge-level rate limiting rules.
Data minimization
We collect only what is needed to evaluate and respond to an application or inquiry — see our Privacy page.
Security headers
A strict Content-Security-Policy and standard hardening headers (X-Content-Type-Options, Referrer-Policy, Permissions-Policy) are set on every response.
No stack traces, ever
API errors return generic, safe messages. Internal errors are logged server-side only, never shown to visitors.
No tracking cookies by default
The public site does not set analytics or advertising cookies by default.
Responsible disclosure
If you believe you have found a security vulnerability affecting this website or Beacon's systems, please contact us at hello@example.org with details. Please report vulnerabilities privately and give us a reasonable time to respond before any public disclosure. Beacon does not currently operate a paid bug bounty program.