Parity
Security · Wave 156

Security posture for founders & partners

Short, honest summary of how this demo is hardened at the HTTP layer and why the data plane stays in the browser.

Wave 724 · Security hub ladder deepen · SAMPLE
5 rungs

SAMPLE Security hub ladder deepen · 5 rungs · Wave 724

SAMPLE deepen — hub · controls · page · headers · deeper ladder on /security.

Wave 724 · Security hub ladder deepen on /security (≠ securityControlsLadderDeepen / securityPageDeepen).

Rungs

5

≠ securityControlsLadderDeepen

Kinds

5

Ladder variety

Wave

724

Post-v32.50 deepen

  1. Rung 1
    hub
    Hub · SAMPLE

    SAMPLE hub ladder stub.

  2. Rung 2
    controls
    Controls · SAMPLE

    SAMPLE controls ladder stub.

  3. Rung 3
    page
    Page · SAMPLE

    SAMPLE page ladder stub.

  4. Rung 4
    headers
    Headers · SAMPLE

    SAMPLE headers ladder stub.

  5. Rung 5
    deeper
    Deeper · SAMPLE

    SAMPLE deeper ladder stub.

SAMPLE Security hub ladder deepen — ladder on /security. Distinct from related packs (securityControlsLadderDeepen / securityPageDeepen). Not live payments, production CRM, claims filing, or licensed advice.

Wave 909 · Security page hub ladder · SAMPLE
5 rungs

SAMPLE Security page hub ladder deepen · 5 rungs · Wave 909

SAMPLE deepen — hub · assess · share · tradeoff · deeper ladder on /security.

Wave 909 · Security page hub ladder deepen on /security (≠ securityHubLadderDeepen / securityControlsLadderDeepen / internalSecurityHubLadderDeepen).

Rungs

5

≠ securityHubLadderDeepen

Kinds

5

Ladder variety

Wave

909

Package 41.6.0 tip

  1. Rung 1
    hub
    Hub · SAMPLE

    SAMPLE hub ladder stub.

  2. Rung 2
    assess
    Assess · SAMPLE

    SAMPLE assess ladder stub.

  3. Rung 3
    share
    Share · SAMPLE

    SAMPLE share ladder stub.

  4. Rung 4
    tradeoff
    Tradeoff · SAMPLE

    SAMPLE tradeoff ladder stub.

  5. Rung 5
    deeper
    Deeper · SAMPLE

    SAMPLE deeper ladder stub.

SAMPLE Security page hub ladder deepen — ladder on /security. Distinct from related packs (securityHubLadderDeepen / securityControlsLadderDeepen / internalSecurityHubLadderDeepen). Not live payments, production CRM, claims filing, or licensed advice.

Wave 602 · Security controls ladder deepen · SAMPLE
5 rungs

SAMPLE security controls ladder deepen · 5 rungs · Wave 602

SAMPLE deepen — headers · csp · threat · pwa · harden ladder on /security.

Wave 602 · security controls ladder deepen on /security (≠ securityPageDeepen / securityControlsDeepen).

Rungs

5

≠ securityControlsDeepen

Kinds

5

Ladder variety

Wave

602

26.6.0 tip

  1. Rung 1
    headers
    Headers · SAMPLE

    HTTP headers stub.

  2. Rung 2
    csp
    CSP · SAMPLE

    CSP posture stub.

  3. Rung 3
    threat
    Threat · SAMPLE

    Threat model stub.

  4. Rung 4
    pwa
    PWA · SAMPLE

    PWA shell stub.

  5. Rung 5
    harden
    Harden · SAMPLE

    Harden bridge.

SAMPLE security controls ladder deepen — ladder on /security. Distinct from securityPageDeepen / securityControlsDeepen. Not live payments, production CRM, claims filing, or licensed advice.

Wave 531 · Controls · SAMPLE
5 controls

SAMPLE security controls · 5 rungs · Wave 531

SAMPLE deepen — access · secrets · encryption · audit · incident control ladder on /security.

Wave 531 · control-domain ladder on /security (≠ securityPageDeepen).

Control rungs

5

≠ practices strip

Demo posture

3

local-first

Wave

531

≠ securityPageDeepen

  1. Rung 1
    Access control · SAMPLE
    demo

    Local-first demo — no shared multi-tenant auth server in v1.

  2. Rung 2
    Secrets hygiene · SAMPLE
    demo

    No production credentials in the demo; env stubs only.

  3. Rung 3
    Encryption posture · SAMPLE
    demo

    TLS in transit assumed at edge; browser storage is clear-text demo state.

  4. Rung 4
    Audit trail · SAMPLE
    planned

    Local activity stubs — not a SIEM or immutable audit log.

  5. Rung 5
    Incident response · SAMPLE
    planned

    Ops incident banner + runbook stubs — illustrative only.

SAMPLE security controls deepen — control-domain ladder and CTAs on /security. Distinct from securityPageDeepen practices strip. Not a SOC 2 report, penetration-test attestation, VPAT, or production hardening certificate.

Wave 399 · Security · SAMPLE
7 practices

SAMPLE security deepen · 5 shipped · 1 relaxed · 1 planned

SAMPLE deepen — HTTP headers · CSP posture · local-first threat model · honest “what this is not”.

7 practice chips — headers + local-first threat model labeled SAMPLE; CSP stays intentionally relaxed for Next.

  • HTTP security headers

    shipped(SAMPLE)

    CSP, XFO DENY, nosniff, Referrer-Policy, Permissions-Policy, COOP on all core routes.

    Open related · SAMPLE

  • CSP enforcing (intentionally relaxed)

    relaxed(SAMPLE)

    Allows unsafe-inline for Next hydration; nonce + strict-dynamic is the production hardening path.

    Open related · SAMPLE

  • Clickjacking / framing

    shipped(SAMPLE)

    frame-ancestors none + XFO DENY; /embed/* intentionally open for partner iframes.

    Open related · SAMPLE

  • Local-first threat model

    shipped(SAMPLE)

    No auth server, no shared multi-tenant DB, no PII egress in v1 — browser storage is the primary surface.

    Open related · SAMPLE

  • Not a SOC 2 / pen-test attestation

    shipped(SAMPLE)

    Honest labeling: demo posture only — do not put real SSNs or production credentials in the app.

    Open related · SAMPLE

  • PWA shell (no payload cache)

    shipped(SAMPLE)

    Optional SW precaches offline shell only — no insurance payload caching or background sync.

    Open related · SAMPLE

  • Strict nonce CSP via Proxy

    planned(SAMPLE)

    Planned production hardening: per-request nonce + strict-dynamic once a Proxy layer lands.

    Open related · SAMPLE

SAMPLE security page deepen — practices strip with posture chips on /security. Not a SOC 2 report, penetration-test attestation, VPAT, or production hardening certificate.

HTTP security headers

next.config ships Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy (camera/mic/geo/payment/usb off), Cross-Origin-Opener-Policy: same-origin, and DNS prefetch control on all routes.

CSP — enforcing, intentionally relaxed

CSP is enforced (not report-only) but allows 'unsafe-inline' for scripts and styles so Next.js hydration and CSS-in-JS patterns work without a per-request nonce Proxy. 'unsafe-eval' remains so next dev React stacks work; production React/Next do not rely on eval by default. A strict nonce + strict-dynamic CSP is the production hardening path when we add Proxy.

Clickjacking & embedding

frame-ancestors 'none' plus X-Frame-Options: DENY keep the demo from being framed — except /embed/* (Wave 74 gap teaser), which uses frame-ancestors * and omits X-Frame-Options so partners can iframe it. Core product routes remain unframed.

Local-first threat model

There is no auth server, no shared multi-tenant database, and no PII egress in v1. The primary risk surface is the user’s own browser storage and any machine with access to that profile. Export JSON may contain household details you entered — treat downloads like documents.

What this is not

Not a SOC 2 report, not a penetration-test attestation, not licensed insurance infrastructure. Quotes and waitlists are illustrative. Do not put real SSNs, full card PANs, or production credentials into the demo. Health cost figures are educational models — see HEALTH_DATA honesty.

PWA / service worker (shell only)

Optional /sw.js precaches /offline + manifest + icons under worker-src 'self'. It does not cache insurance payloads or provide background sync. Installability comes from the web app manifest — see PWA.md.

Header checklist

HeaderDemo setting
Content-Security-PolicyEnforcing; relaxed for Next/inline (documented above)
X-Frame-OptionsDENY (omitted on /embed/*)
X-Content-Type-Optionsnosniff
Referrer-Policystrict-origin-when-cross-origin
Permissions-PolicySensitive APIs disabled by default
Cross-Origin-Opener-Policysame-origin

Source of truth: next.config.ts → headers().

Privacy & trust

Headers do not replace consent. Read the privacy center for localStorage scope and the trust page for opt-in agent contact.