Security Practices

We teach web application security, so it matters to us that CyUnified itself is built with the same practices we write about. Here's a plain-language overview of how we approach protecting this site and the limited data we hold.

Transport security

All traffic to cyunified.com is served over HTTPS, so data between your browser and our server is encrypted in transit.

Authentication & passwords

Contributor account passwords are never stored in plain text — they're hashed using industry-standard, slow hashing algorithms designed specifically to resist brute-force attacks, exactly as described in our own password security lessons.

Session & cookie security

Session cookies are configured with the security attributes covered in our session management curriculum — restricting when and how they're sent — to reduce the risk of theft or misuse.

CSRF protection

Forms on this site, including the contact form, are protected against cross-site request forgery — the exact vulnerability class covered in our CSRF lesson — so a request can't be forged from another site and processed as if it came from you.

Data minimization

We collect the minimum data needed to run the site — mainly what you voluntarily submit through our contact form. See our Privacy Policy for the full detail on what we collect and why.

Abuse prevention

Our content pages are rate-limited to blunt automated scraping and bulk-scanning activity, while staying generous enough not to affect normal browsing.

Honest limits

CyUnified is an independently run project, not an enterprise system with a dedicated security team or a formal audit history. We apply the practices above in good faith and keep improving them, but we can't claim a level of assurance a certified, professionally audited service could. If you find a gap, please let us know — see our vulnerability disclosure policy.