Restricted content sources
The site serves its own scripts and styles. The content security policy also allows Google Analytics after consent and Google reCAPTCHA when you open the request review; it restricts other sources, framing and plug-ins.
Security
Security
This page explains the website’s technical setup and how local tools differ from external form, spam-check and booking services. Technical measures do not provide an absolute security guarantee.
Short answer
The website is static. Google Analytics loads only with consent. Security headers restrict scripts, framing, referrers and browser capabilities. One bounded Formspree endpoint processes only deliberately submitted contact requests.
Technical foundation
Minimal data flow
No uploads, AI processing or CRM integration. Analytics loads with consent. Formspree processes requests; Google reCAPTCHA provides the spam check when you open the request review.
Local scans
Scans, the guide and calculator process answers locally. A deliberate language switch temporarily transfers valid information through sessionStorage in the same tab; this is not automatic transmission to a supplier.
Automated checks
The source project contains automated checks for routes, links, metadata, headers and selected interaction flows. Release reports record which checks were actually run and their limitations.
Scope of the technical measures
The public website uses HTTPS and restrictive headers, including a content security policy, a referrer policy and protection against framing. It has no upload feature or account portal. Optional external services have their own processing and access arrangements.
Report a security concern
You can send Joshua an initial report at joshua.boermans@korper.nl. Include the affected page and a short description, without passwords, exploit details, technical addresses or confidential files. Agree how further details can be shared before sending them. Joshua receives and follows up on initial reports through this business address.
Send an initial report
Include only a short description and page address.
Email Joshua without sensitive detailsAbout this information
Content contact: Joshua Boermans. Updated on 9 October 2026.
This describes the website setup and limits of the checks. Independent specialist validation has not been recorded.