Security

Updated October 16, 2026

How this site is built

• Served over HTTPS only, from Cloudflare's network.
• No JavaScript runs in your browser on this site. Pages are plain HTML and CSS.
• A strict Content Security Policy blocks every outside resource: nothing loads from a third-party domain.
• No cookies, no sessions, no user accounts, so there is nothing to steal from a visitor.
• Photos are served from private storage through our own code; the storage itself is not publicly reachable.
• The code that runs the site is a single, reviewed file in our own Cloudflare account. No plugins, themes, or third-party packages.

What we don't hold

We never hold visitor accounts, passwords, or payment information. Purchases happen on the store you're sent to; their security practices cover the transaction.

Reporting a problem

If you find a vulnerability or something that looks wrong, email savannabellecollective@gmail.com with what you saw and how to reproduce it. We read every report, fix real issues promptly, and will credit you if you'd like. Please don't test against the site in ways that could disrupt it for other visitors, and don't access data that isn't yours. A machine-readable version of this is at /.well-known/security.txt.