Awalim Groupعوالِم قروب
ع Start your project

Securityالأمان

We don't promise security. We attack ourselves in front of you.

Every security page you have ever read is a list of promises. This one runs five real attacks against itself in your browser right now and shows you the browser refusing each one. If our policy ever weakens, this page will be the first thing to tell you.

Live proofبرهان حيّ

Five attacks, running now

Not a simulation: each probe is the hostile action itself, and each verdict is read from the browser's own violation event or the exception the platform threw.

    Press to run the attacks — or scroll here and they start on their own.

    Postureالوضع

    What actually stops it

    These are not settings written once and forgotten — the build generates them from the code that ships, so they cannot drift away from the page.

    A hash for every inline scriptNo unsafe-inline in script-src. The build computes a SHA-256 of every inline script and puts it in the policy; change one character and the hash changes with it.
    None in the styles eitherThe site carried around 950 inline style attributes with only 74 distinct values between them. They are generated classes now, so unsafe-inline left style-src too.
    Trusted Types enforcedNine places that built HTML out of strings were removed — the worst of them passed your own typed words through. One named policy remains, and it can mint the service worker's URL and nothing else.
    Nothing from anyone else's serverNo fonts, scripts or images from a foreign origin. No tracking, no cookies, no analytics. What is never loaded can never be compromised.
    Our numbers are signedEvery public number is signed with an Ed25519 key at build time, and your browser is what verifies it — not our server.
    The contact form sends nothingWhat you type never passes through our server at all; it opens WhatsApp or your mail client on your own device.

    The policyالسياسة

    The actual policy our server sends

    Not an illustrative example — this is the header itself, generated by the build from the code that ships.

    1. default-src'self'
    2. script-src'self' 'sha256-WdDJbdhgd2aGIBSxWgROYpfUiSkQnu8zmjTf1J991Hg=' 'sha256-ZriVhTnq4wXlPojnCD2FutefCZLnRiHrDymHXGI2euA=' 'sha256-ut8FCfD/iBAMUY8iebvxN0PzWbOrNiN2o3NDD53XFQY='
    3. style-src'self' 'sha256-KR4gUwZTOejHuo8xbgVympE27JrzLkGZLeE45cOmXJE='
    4. img-src'self' data:
    5. font-src'self'
    6. connect-src'self'
    7. form-action'self' https://wa.me
    8. frame-ancestors'none'
    9. base-uri'none'
    10. object-src'none'
    11. require-trusted-types-for'script'
    12. trusted-typesawalim-sw awalim-ledger
    13. upgrade-insecure-requests

    Honestlyبصراحة

    What this policy does not do

    • It does not protect you from a mistake in content we write and trust ourselves. It stops injection, not bad judgement.
    • It does not protect a device that is already compromised — a malicious browser extension comes before any policy.
    • The site is static, with no database and no accounts, so there is nothing in it to steal. That is not a virtue of ours; it is the shape of the site.
    • This page proves the policy you were served, and nothing more. If our host ever sent a header that differs from the one we declare, these five checks would still come back green for you. The build verifies the other side — that what is declared matches what ships — and the two together cover both ends.
    • Trusted Types is what actually refuses the eval and innerHTML probes — measured: adding unsafe-eval to the policy does not bring them back, because the platform refuses the sink before the content policy is consulted.

    Disclosure

    Found a hole?

    Tell us directly and we answer within one working day. We have no bounty programme yet and will not pretend otherwise — but we credit whoever reports, if they want it.

    ceo@awalimgroup.com WhatsApp us
    • We reply within two working days
    • The code is entirely yours
    • Published numbers, signed and verifiable