How the site is protected

Encrypted connections only. HTTPS is enforced, with HTTP Strict Transport Security (HSTS).
Strict Content Security Policy. Only this site's own scripts and Cloudflare's visit counter can run. Inline code is blocked, except one small script allowed by its SHA-256 hash. Other sites cannot embed these pages in a frame.
No third-party content. Fonts, scripts and images are served from this site.
No accounts. There are no logins, passwords or payment details to steal.
Careful forms. Only requests from this site are accepted. Submissions are size-limited and rate-limited, every answer is checked against a fixed list, database queries are parameterised, and a hidden field stops bots.
Data minimisation. IP addresses are not stored, and questions are deleted after 12 months. Privacy
Monthly checks. An automated job checks every source link and flags pages that need reviewing.

Report a vulnerability

If you find a security problem, email info@adhd.advocacy.ge with the subject "Security". Please include the steps to reproduce it. Contact details are also published in security.txt.

When testing, please:

do not access, change or delete other people's data, including survey answers and questions
do not disrupt the site, for example with denial-of-service or high-volume automated scanning
give reasonable time to fix a problem before you publish it

Good-faith research that follows these rules is welcome.