Skip to content

We hold our own site to the standard we’d hold yours to.

A security company that will not be inspected is not worth hiring. Here is how this site and this domain are built, and how to check it yourself.

Six deliberate choices

No login, no database, no CMS

The site is static files on a CDN — no PHP, no database, no admin page to brute-force. The one piece of server-side code is a small function that forwards the enquiry form; it reads nothing, stores nothing, and holds a single key that can deliver to our own enquiries mailbox and nowhere else.

Nothing loads from anywhere else

Fonts and images are served from this domain. No Google Fonts, no reCAPTCHA, no analytics beacon, no embeds. Reading this page tells no third party you were here.

A strict Content Security Policy

The browser is told exactly what is allowed to run, with no inline-script escape hatch.

Email that cannot be spoofed

DKIM signing and an enforcing DMARC policy, so nobody can send mail that appears to come from us. The table below shows you how to check.

TLS, certificates and DNS

Modern TLS only — TLS 1.0 and 1.1 are refused at the edge — with HSTS, certificate issuance pinned with CAA so no other authority can issue a certificate for this domain, and DNSSEC on the zone so our DNS answers cannot be forged in transit.

A way to report a problem

A published security.txt with a monitored address and a disclosure policy — so a researcher who finds something has somewhere to send it.

Check it yourself

CheckWhat it tests
Mozilla ObservatoryHTTP headers and CSP
Qualys SSL LabsTLS configuration
HardenizeDNS, email and TLS together
security.txtHow to report a vulnerability to us
dig +short TXT _dmarc.example.com Email spoofability — no output, or output containing p=none, means anyone can send mail as that domain. Try us, your firm, your IT provider.
/.well-known/security.txt
# Cyber Legionnaire — vulnerability disclosure
# RFC 9116. If you have found a security issue in this site or our
# infrastructure, we want to hear about it and we will not pursue you for
# reporting it in good faith.

Contact: mailto:security@cyberlegionnaire.com
Expires: 2027-08-10T00:00:00.000Z
Preferred-Languages: en
Canonical: https://cyberlegionnaire.com/.well-known/security.txt
Policy: https://cyberlegionnaire.com/audit-us/

A perfect score on a brochure site is an easy A.

Anyone technical knows a static site with no login is not hard to secure. The point is the unglamorous items — DKIM, MTA-STS, a working vulnerability-disclosure address — that are easy to skip, because nothing visibly breaks when you do. We did them because we ask our clients to.

One of these checks is a study we ran ourselves: the _dmarc lookup beside this, against 3,821 small Canadian professional firms’ domains. 77% of those that receive email have no enforced DMARC policy — anyone can send mail that appears to come from them. That one lookup, nothing else. Method and full results →

How does your firm score?

The free Security Snapshot runs these same checks against your domain and explains what they mean in plain English. No cost, no obligation — you keep the findings either way.

Get your free Security Snapshot

  1. Tell us your domain

    One short form. No access to your systems, no software to install.

  2. We look from the outside

    Passive, publicly observable checks only — the same view an attacker gets.

  3. You get one page

    Your top findings in plain English — one page, no meeting required.