Security
Separating what is already true from what is designed is the entire point of this page. A security page that mixes the two is worse than none, because it teaches you to discount all of it.
What is already true
Everything is served over HTTPS, with a certificate from Let’s Encrypt that renews on a schedule and a check that fails loudly if a renewal does not happen. Plain HTTP is redirected, and the site sends Strict-Transport-Security so your browser refuses to try again in the clear.
The site sends three security headers on every response, including the static files: Strict-Transport-Security, X-Content-Type-Options: nosniff and Referrer-Policy: strict-origin-when-cross-origin. The last one is why the full URL you came from is not handed to third parties.
There is nothing to breach here. No account, no password, no database and no personal data, because the site collects none. That is not a control we implemented; it is a consequence of the product not existing yet, and it stops being true the day it does.
Nothing we put on this site contacts a third party. Every script, stylesheet, font and image we reference is served from this server. Until 23 August 2026 the typefaces came from Google’s CDN and that was the single exception; they are self-hosted now.
The edge injected two scripts we did not put there, and both are off since 23 August 2026. One was a measurement beacon from static.cloudflareinsights.com. The other was an email decoder, which arrived because the edge rewrote the two addresses in the footer of every page into an encoded form that needed JavaScript to read. Both were account defaults rather than choices. Checked after turning them off: zero injections across the eleven pages on all three hostnames, and the footer addresses are plain text again with JavaScript disabled.
This is recorded rather than deleted for the same reason the fonts are: a page that separates the true from the designed has to keep the entries that stopped being inconvenient, or there is no way to check it against its own history.
The mail domain is properly signed. SPF, DKIM on two selectors and DMARC at quarantine are published for scalebatch.com, and a daily check compares the key published in DNS against the key actually used to sign. Mail claiming to come from this domain and failing those checks is not from us.
What is not in place yet
There is no Content-Security-Policy. The three headers above are the ones that cannot break a page; a CSP can, and putting one up that is wrong is how a site ends up shipping unsafe-inline and pretending it counts. It goes up when it has been measured against every page, not before.
Everything about the product is a design, not a control. Authentication, roles, encryption at rest, audit trails, backups, tenant isolation: all of it is specified and none of it is running, because there is no product. When there is, this page will say which of them are true and which are still on paper, in the same two-part shape.
Reporting something
Write to security@scalebatch.com. Tell us what you found and how to reproduce it. There is no bounty programme and we are not going to pretend there is one; what we will do is answer, fix it, and credit you on this page if you want to be credited.
If a change here affects someone, they get told before it takes effect. Today the list of affected people is empty, and this page says so rather than implying a process that has never run.