The site practices what the product preaches
Hollowpath builds security tooling, so hollowpath.org itself should hold up to scrutiny. This page describes what’s actually configured — not a generic checklist.
This website
TLS 1.2 / 1.3 only
Older TLS versions are rejected at the server. Certificates renew automatically.
A real security-header baseline
Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and frame-ancestors are all set — and the policy was written against what this site actually loads, not copied from a template.
Minimal exposed surface
Only SSH and HTTPS are reachable from the internet. The application server itself binds to localhost only and is unreachable directly, independent of the firewall rule that also blocks it.
No tracking
No analytics, no third-party scripts, no cookies. There's nothing here to leak because nothing is collected.
Explicit Host-header handling
Requests with an unrecognized Host header or direct IP access are rejected outright rather than silently served.
The product
Hollowpath enforces a default-deny scope engine on every reconnaissance and exploitation action — a target is treated as unauthorized unless it can be positively confirmed in scope. This is enforced by the engine itself, at every execution boundary, independent of what any confirmation dialog displays. The GUI is never the actual security boundary; the engine is. Full detail in the security philosophy docs.
Found a security issue? Read the disclosure page.