Security and Privacy

StarryBio’s security model is intentionally simple: it serves a static public profile page. That removes account, database, and server-session risks from the stock deployment, but it also means every configured piece of visitor-facing content is available to anyone who can load the page.

What is public

The build places these values in static HTML, JavaScript data, or downloadable files when configured:

• Profile name, description, image URL, links, link subtitles/descriptions, and featured-card details.
• Copy button copyValue text.
• Status labels, schedule, response messages, and configured owner timezone.
• Announcement text and URL.
• SEO metadata, canonical URL, and social image URL.
• Analytics provider names, client-side tokens/IDs, script URLs, and custom data attributes.
• QR code content and vCard fields.

Do not put passwords, API keys, Cloudflare API tokens, private invite URLs, personal data you do not intend to publish, or secrets intended for a server in config/starrybio.config.ts. A static site cannot protect a value that its browser must receive.

No accounts, secrets, or data store

The stock application has:

• no user account or administrator login;
• no authentication provider;
• no database, D1, KV, R2, Durable Object, queue, or runtime storage;
• no form handler or API endpoint;
• no runtime environment variable or hosting-provider binding requirement.

Site administration is source-code access plus authority to deploy through the selected host. Protect the repository, provider account, and any CI credentials accordingly. Use least-privilege access and never commit deployment credentials to the repository.

Browser security headers

pnpm headers generates public/_headers from the selected analytics configuration and updates Vercel’s equivalent rules in vercel.json. pnpm validate and pnpm build fail when either generated policy is stale. Cloudflare Workers and Netlify use the resulting _headers file; Vercel uses vercel.json.

GitHub Pages cannot apply those custom response headers, but generated pages include the compatible CSP directives in HTML. Choose a host with response-header controls when full header coverage is required.

Header/policy	Current intent
Content Security Policy	Limits scripts, connections, images, frames, forms, and other resource types.
Strict-Transport-Security: max-age=31536000	Tells browsers to use HTTPS for future visits.
X-Content-Type-Options: nosniff	Prevents MIME sniffing.
Referrer-Policy: strict-origin-when-cross-origin	Limits cross-origin referrer detail.
Permissions-Policy	Disables camera, microphone, and geolocation.
X-Frame-Options: DENY and CSP frame-ancestors 'none'	Blocks framing/clickjacking.

The CSP uses default-src 'self', disallows objects, limits forms to the same origin, and does not allow script-src 'unsafe-inline'. It permits HTTPS images because StarryBio supports remote image URLs. Script and connection origins are scoped to the selected analytics provider.

After changing analytics, run pnpm headers, then build and preview. Do not broadly replace the policy with https: or add unsafe-inline merely to make an error disappear. See SEO and Analytics.

Links and assets

The configuration schema rejects unsafe link schemes such as javascript: and blocks local asset path traversal. External HTTP(S) links receive target="_blank" with rel="noopener noreferrer", preventing the opened site from controlling the originating page through window.opener.

Validation can accept HTTP remote assets because it supports the configuration, but production links, images, analytics scripts, and canonical URLs should use HTTPS. An HTTP asset can expose visitor requests or be blocked as mixed content when the profile itself is served over HTTPS.

Use reputable remote hosts, or prefer versioned local assets in public/. StarryBio cannot enforce the privacy or availability of a third-party image CDN, external destination, or analytics service.

Analytics and privacy

Analytics scripts execute in visitors’ browsers and send data under the external provider’s rules. StarryBio does not provide consent management, an opt-out interface, data deletion tools, proxying, or retention controls.

Before enabling analytics:

1. Decide whether analytics is necessary for this public profile.
2. Review the provider’s data practices and applicable local requirements.
3. Add a privacy notice or consent mechanism outside StarryBio if your usage requires one.
4. Keep custom analytics data attributes non-sensitive.
5. Test that the CSP permits only the exact provider hosts needed.

Cloudflare Web Analytics and other browser tokens/IDs are identifiers intended to be present client-side. They are not a substitute for a Cloudflare API token and should never grant account administration access.

Cookies and visitor behavior

The only bundled first-party cookie is set after a visitor dismisses an enabled announcement. Its name is starrybioAnnouncement, it stores a short derived identifier rather than the announcement text, is scoped to /, has SameSite=Lax, and expires after seven days.

The status feature calculates availability in the visitor’s browser using local time. It does not send a visitor’s timezone to StarryBio, but any separate analytics provider may collect information according to its own configuration and policy.

Safe operations checklist

1. Keep config/starrybio.config.ts, provider configuration, and _headers under review and version control.
2. Run pnpm validate, pnpm build, and pnpm preview before each production deploy; use pnpm preview:cloudflare for Cloudflare-specific checks.
3. Do not paste full config files, browser network logs, or provider authorization material into public issues if they contain identifiers you do not want public.
4. Update dependencies and run pnpm release:check before significant releases.
5. Report a StarryBio vulnerability privately through the repository’s GitHub Security Advisory form, not through a public issue.

For deployment authority, rollback, and backups, continue with Operations and Updates. For a CSP or asset failure, see Troubleshooting.