Security
Security at Lapetto
What this site does and does not do with your data today.
Report a vulnerability
Email security@lapetto.com. We do not run a bug bounty, but we read that inbox and reply.
How the site works today
- The site is served by Firebase Hosting over HTTPS.
- No card data reaches this site. Online payments are paused, so the site takes no payments at all; pieces can be reserved by email.
- No accounts or passwords. Sign-in is switched off for now.
- Forms are not connected: the newsletter and contact forms do not send or store anything yet. They load a Cloudflare Turnstile bot check so the protection is in place when they are connected.
- Your bag is kept only in your browser’s local storage.
Browser protections
Pages are sent with a Content-Security-Policy that only allows scripts, styles, fonts and images from this site (plus Cloudflare’s bot check), with no inline scripts. They also send HSTS, X-Content-Type-Options, X-Frame-Options DENY, a Referrer-Policy, a Permissions-Policy and a Cross-Origin-Opener-Policy.
When online payments open
Card payments will be taken on Stripe’s hosted checkout (PCI DSS compliant), with payment secrets kept server-side and never in the browser, and this page will be updated to describe how.