Security

Last updated 14 November 2026.

Reporting a problem

If you believe you have found a security problem in Merkava or this website, please tell us through the contact form and choose "A security report". Give us enough detail to reproduce it, and please do not access other people's data or disrupt the service while testing. We will acknowledge your report promptly, keep you informed, and credit you if you wish once it is fixed.

How the website is protected

• It is served only over HTTPS with HTTP Strict Transport Security, and reaches our servers through an outbound-only encrypted tunnel, so no server port is open to the internet.
• It sets a strict content security policy, loads no third-party scripts and sets no cookies.
• Requests are rate limited and the form rejects oversized or automated submissions.
• The Merkava application itself is on a separate address and sits behind an identity check.

A machine-readable contact is published at /.well-known/security.txt.