Security / trust centre

Last reviewed 30 October 2026. This page documents what is actually deployed — not a badge wall. Every claim below can be checked with curl, dig or the published hashes.

the model

Static by defaultsurface

Pages are pre-built HTML/CSS/JS on Cloudflare. There is no database, no login, no admin panel exposed to the public and no server-side template that renders user input as HTML.

No accounts, no adsprivacy

No sign-up, no cookies for tracking, no ad network, no third-party analytics script. The only write endpoints are the feedback form and device submission, both rate-limited and size-capped.

Same-origin everythingcsp

Scripts, styles, images and fonts are self-hosted. The Content-Security-Policy is default-src 'none' with explicit allow-lists, so injected markup has nothing to execute.

Verifiable downloadssupply chain

Every APK, deb and exe lists its size and SHA-256. Source archives are on Codeberg under the same tag. If a hash does not match, do not install it.

transport and DNS

HTTPS only. Plain HTTP is answered with a one-hop 301 to https://www.getyahrootback.com; HSTS is max-age=31536000; includeSubDomains; preload.
One canonical host. The apex, the old *.admindashboard.dev names and the workers.dev alias all 301 to www, preserving path and query.
DNSSEC signing is enabled on the zone; the DS record is being published at the registrar. Once the DS is live, resolvers can validate the chain.
Email anti-spoofing. v=spf1 -all, DMARC p=reject; sp=reject with strict alignment, and a null MX. The domain does not send mail, so anyone claiming to is spoofing.
CAA pins issuance to Cloudflare's supported CAs (Let's Encrypt, Google Trust Services, SSL.com, Sectigo, plus the DigiCert/Comodo records Cloudflare manages for Universal SSL).

response headers

Content-Security-Policy — default-src 'none'; self-hosted script/style/img; frame-ancestors 'none'; upgrade-insecure-requests.
Strict-Transport-Security — one year, subdomains, preload.
X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer.
Permissions-Policy — camera, microphone, geolocation, USB, payment and topics disabled.
Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Resource-Policy: same-origin.
Content-Security-Policy-Report-Only with Trusted Types enforcement, reporting to a rate-limited endpoint.

application controls

Input handling. Feedback and device submissions are JSON-only, capped at 20 KB, stripped of control characters and angle brackets, and stored as data — never rendered as HTML.
Abuse controls. Honeypot fields, per-IP salted-hash rate limits (feedback 6/hour, submissions 4/hour, CSP reports 30/minute) and a hard cap on stored records.
Scanner handling. Known probe paths (/.env, /.git, /wp-admin, actuator, etc.) return a plain 404 and are logged as security events, with an optional webhook alert.
Secrets. The IP salt and stats key are Worker secrets, not source. The stats and submission views are key-gated and return 404/401 without the key.
Cloudflare edge. DDoS protection is always on. Zone-level WAF managed rules and Bot Fight Mode are managed in the Cloudflare dashboard; the current API token does not have permission to change them.

verify a download

Every artifact page lists the exact byte size and SHA-256. To check a file you already downloaded:

sha256sum UnboltHub-0.6.6.apk
# Windows: certutil -hashfile UnboltHub-0.6.6.apk SHA256
# macOS:   shasum -a 256 UnboltHub-0.6.6.apk

Compare the output with the value on the downloads page. The same hash is in /assets/versions.json for updaters. Source for each release is at codeberg.org/getbacktoyahroots.

reporting a vulnerability

Please report suspected vulnerabilities privately through the Codeberg issue tracker or email getbackyahroots@gmail.com. Include the URL, a reproduction, and the impact you believe it has. Do not test against other people's devices or data, and do not run destructive load tests. We will acknowledge a valid report, fix it, and credit you if you want.

Machine-readable contact: /.well-known/security.txt (RFC 9116, expires 2027-10-30).

known limits

This is a static site with a small Worker. There is no bug bounty and no 24/7 SOC.
Rooting tools necessarily run with elevated privileges on your own device. Verify hashes and read the source before flashing anything.
Zone-level WAF/bot settings and DNSSEC DS publication are controlled from the Cloudflare dashboard and are noted above where they are pending.