Public methodology

Security checks, documented without a black box.

Learn what Chalo observes, how a result is classified, where the check stops, and how to remediate a failed control.

This library covers implemented checks. Additional articles will be added as methodology expands.

HTTP Strict Transport Security

HSTS tells supporting browsers to use HTTPS for future requests.

Plain HTTP requests should be upgraded before content is served.

CSP constrains which resources a browser may execute or load.

Frame controls reduce the risk of a site being embedded in a deceptive interface.

Referrer Policy limits URL information sent during navigation.

SPF identifies mail systems authorized to send for a domain.

DMARC tells receivers how to handle mail that fails domain alignment.