Proof
Here we measure instead of claim
Security sites often show badges. This page shows what this site actually does, with the date and method of every measurement.
What your browser just received
This is the content security policy applied to this page, read live from your request. The nonce, different on every visit, is masked.
| Header | Value |
|---|---|
default-src | 'self' |
script-src | 'self' 'nonce-…' 'strict-dynamic' |
style-src | 'self' 'nonce-…' |
img-src | 'self' data: |
font-src | 'self' |
connect-src | 'self' |
object-src | 'none' |
base-uri | 'self' |
form-action | 'self' |
frame-ancestors | 'none' |
upgrade-insecure-requests | — |
The other security headers
Values from the site configuration. An automated test checks on every change that they are really sent on every page.
| Header | Value |
|---|---|
X-Content-Type-Options | nosniff |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() |
X-Frame-Options | DENY |
Cross-Origin-Opener-Policy | same-origin |
Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
Latest measurements
Lighthouse scores (out of 100) measured on the production build.
Measured on 2026-10-09 · Lighthouse 13.5.0, median of 3 runs · Conditions : mobile emulation, simulated slow network, local server (origin latency not included, see ADR 0001)
| Page | Performance | Accessibility | Best practices | SEO | LCP (ms) | Weight (KB) |
|---|---|---|---|---|---|---|
/fr | 99 | 100 | 100 | 100 | 2119 | 222 |
/fr/expertises | 99 | 100 | 100 | 100 | 2109 | 219 |
/fr/preuves | 99 | 100 | 100 | 100 | 2110 | 220 |
/en | 99 | 100 | 100 | 100 | 2108 | 221 |
How to reproduce
Every measurement comes from a versioned script. Results vary by a few points between runs: we publish one measurement, not the best of ten.
npm run build · npm run serve:prod · npm run lighthouse
Automated checks on every change
- Accessibility: axe (WCAG 2.2 AA) on every page, in French and English, in light and dark mode.
- Security: headers and a strict content policy with no “unsafe-inline” or “unsafe-eval”, and a different nonce on every request.
- Privacy: no request to another domain, no cookie, no content policy violation.
- Robustness: the text stays readable without JavaScript.
- Delivery pipeline: production module audit, secret detection, code and image scanning.
What we do not claim
- This site claims no certification (SOC 2, ISO 27001…).
- No penetration test has been carried out on this site yet; one is planned before interactive features open.
- These measurements concern this site.