What we ship, what we don't, and where third parties grade us.

Short version: this site holds none of your money and none of your keys. The personal data tied to it is the newsletter list, which Buttondown keeps for us, and a server log that clears after 3 days; the privacy page says what each holds. Our server holds a single Buttondown key so the signup form works. Apart from that key and that short log there is nothing here to drain or steal. The strongest security posture is having little worth attacking, and we lean on that.

That is not an excuse to ship sloppy. Here is exactly what we run, where third parties grade it, and where we know we still owe work.

What we ship

• HTTPS only. TLS 1.2 and 1.3. Cloudflare manages certs via Let's Encrypt and Google Trust Services. We publish CAA DNS records so no other CA can issue a cert for this domain even if compromised.
• HSTS with preload. Once your browser visits us over HTTPS, it refuses to fall back to plain HTTP for a year. We are on the browser preload list so the protection covers your first visit too.
• Strict Content Security Policy. Every executable script on every page is allow-listed by SHA-256 content hash. No unsafe-inline anywhere. A build-time linter blocks new inline scripts so the policy cannot quietly erode.
• No third-party scripts. No ad networks, no tag managers, no chat widgets, no Google Fonts, no embedded iframes. Plausible analytics is proxied through our own Cloudflare Worker so it is same-origin - adblockers do not block it and a CDN compromise cannot backdoor it.
• The newsletter form. A plain HTML form that posts to our own server. It loads nothing from anyone else. Our server passes the address to Buttondown with an API key stored as a Cloudflare secret, never in the code or the repo. The key cannot send email or change account settings. It can manage subscribers, and in Buttondown that includes reading the list and its open and click records, so we treat it like a password and replace it if it ever leaks.
• No cookies, no tracking pixels on this site. Plausible is cookieless. The only browser storage we set is lb_progress_v1, which holds your reading progress and never leaves your device. (Cloudflare sets its own cf_clearance / __cf_bm cookies for abuse mitigation; we do not read them.) The newsletter emails are the exception: they carry Buttondown's open-tracking image and click-tracking links, and the privacy page says what they record and where they are hosted.
• Locked-down CI. GitHub Actions third-party actions are pinned to commit SHAs, not mutable @v4 tags. Workflow tokens are scoped to read-only by default. Dependabot opens grouped update PRs weekly.

Independent grades

We do not embed badges. Badges go stale, and they are just third-party JavaScript that we would then have to allow in our CSP. Click through and re-run the scan yourself:

• Mozilla Observatory - combined HTTPS, headers, cookies, and CSP grade.
• securityheaders.com - HTTP response header configuration.
• SSL Labs - TLS and certificate configuration.

What we don't claim

This is a content site that serves HTML and a few PNGs. We do not:

• Hold any of your money, keys or seed phrases. The personal data tied to the site is the newsletter list, which Buttondown holds, and a server log that clears after 3 days; the privacy page lists both.
• Run any custodial service, exchange, or wallet.
• Promise zero-day-fix SLAs. We rescan after every significant change and patch real findings within 14 days.

Report a vulnerability

Email hello@learnbitcoin.com with subject starting [security]. We aim to acknowledge within 72 hours and ship a fix or mitigation within 14 days for anything with real impact.

We do not run a paid bug bounty. Substantive disclosures get credited publicly if you want it.

Changes

This page, like the rest of the content, lives in our public content repo. Every change is in git history. We will not silently rewrite our security claims.