Dated external checks
Mozilla Observatory: the Hebrew site's security configuration received A+ on 24 October 2026, passing 11 of 12 checks. Integrity verification of an external script was an improvement item in that dated report. On 27 October 2026, the measurement script was moved to the site itself and permission to load it from the external server was removed. The grade shown is the original result, not a repeat check after that change. View the report.
Qualys SSL Labs: the HTTPS connection configuration received A+ across all four endpoints checked on 24 October 2026. View the report.
Additional checks - 27 October 2026
Sucuri SiteCheck: The external check on 27 October 2026 detected no malware and did not find the site on the nine blocklists checked. The check covers publicly accessible content, not the server's internal systems. View the report ↗
ZAP: The latest passive scan, on 27 October 2026, followed the move to a locally hosted measurement script and a tighter code-loading policy. It reported no high-risk alerts. Medium-risk alerts concerned inline styles, cross-origin access to public content and the contact form. These are points to review, not proof that the site can be compromised. No forms were submitted and no active attack tests were performed.
Content Security Policy (CSP) check: The current policy was checked on 27 October 2026 after permission to load the measurement script from an external server was removed. The tool flagged a caution about trusting scripts hosted on the same site: protection also depends on the content that the site serves. This does not establish an exploitable vulnerability or show that the policy prevents every attack.
These are point-in-time checks, not a full penetration test, security certification or guarantee that the site is immune to attack. The passive scan does not cover every page or every data-handling process.
Contact form
Your name, email address, subject and message are passed through Formspree and sent to Shahar's email. Your message is not published. Please do not submit passwords, codes, card details or identity documents.
According to a written statement from Formspree dated 4 November 2026, the site's contact-form provider is SOC 2 compliant. This is the provider's statement, not a claim that this website is SOC 2 compliant; we have not yet reviewed the audit report.
Newsletter subscriptions
The Hebrew newsletter, "בין השורות" (Between the Lines), uses Buttondown for confirmation, delivery and unsubscribe management. Email addresses and subscription data are processed by that service. The English section does not automatically subscribe you to the newsletter or change the language of existing subscriptions.
According to Buttondown's security documentation, data is encrypted in transit and at rest, staff access is limited by need, and automated vulnerability checks are performed. Data is processed in the United States and by subprocessors listed by the company.
These are the provider's stated measures, not a guarantee of immunity or a certification. Buttondown itself is not SOC 2 certified.
Measuring content views
The site uses GoatCounter to measure visits and use of content. Technical information and page-address details may be sent to the service. English page paths are separate from Hebrew paths, so visits to each language can be compared. These figures show which content was viewed. They do not identify visitors or establish which language they speak. Using the site does not mean that no data is processed.
Questions about your information
For questions about information you submitted, or to enquire about access, correction or deletion under applicable law, use the contact page.