# Privacy Assessment Report — mithal.space

> mithal.space is a privacy-focused search engine built on SearXNG, hosted on Ghaymah infrastructure.

---

## 1. HTTPS & Certificate

| Check | Result |
|---|---|
| HTTPS enforced | ✅ Yes — HTTP redirects to HTTPS |
| TLS Version | TLS 1.2 / 1.3 |
| Certificate Issuer | Let's Encrypt (intermediate: `YR1`) |
| Certificate Valid | ✅ Yes (valid 2026-06-17 → 2026-09-15) |
| HSTS Header | ❌ Not observed — missing `Strict-Transport-Security` |

**Finding:** The site correctly enforces HTTPS with a valid Let's Encrypt certificate. The absence of HSTS means browsers will not remember to always use HTTPS on the first visit, leaving a narrow window for SSL-stripping attacks.

**Screenshot:** `screenshots/https-certificate.png`

---

## 2. HTTP Security Headers

Inspected via DevTools → Network → Response Headers on the main document request:

| Header | Present | Observed Value |
|---|---|---|
| `Content-Security-Policy` | ✅ Yes | `default-src 'self'; script-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: http:; connect-src 'self' [ghaymah internal services]; frame-ancestors 'none';` |
| `X-Frame-Options` | ✅ Yes | `DENY` |
| `X-Content-Type-Options` | ✅ Yes | `nosniff` |
| `X-XSS-Protection` | ✅ Yes | `1; mode=block` |
| `Referrer-Policy` | ✅ Yes | `strict-origin-when-cross-origin` |
| `Permissions-Policy` | ✅ Yes | `geolocation=(), microphone=(), camera=()` |
| `Strict-Transport-Security` | ❌ Missing | Not present in any observed response |

**Finding:** Security headers are well-configured overall. The CSP policy allows `'unsafe-inline'` for scripts and styles (necessary for SearXNG), which slightly weakens XSS protection. HSTS is the main missing control.

---

## 3. Cookies

Inspected via DevTools → Application → Cookies → `https://mithal.space`:

**No cookies were observed.**

The site sets no tracking, session, or analytics cookies. This is consistent with a privacy-focused search engine — user state is not persisted between sessions.

---

## 4. Third-Party Network Requests

Inspected via DevTools → Network tab, filtering for third-party domains:

| Domain | Purpose | Privacy Risk |
|---|---|---|
| `fonts.googleapis.com` | Google Fonts CSS | Low — IP address may be logged by Google |
| `fonts.gstatic.com` | Google Fonts files | Low — same as above |
| `t0/t1/t2.gstatic.com` | Search result favicons | Low — loaded only for displayed results |
| `img.youtube.com` | Video thumbnails in results | Low — loaded only when results include videos |

**Finding:** No behavioral tracking services (e.g., Google Analytics, Facebook Pixel, or similar) were detected. The only third-party connections are to Google for web fonts and result thumbnails — both are functional rather than tracking in nature. However, Google Fonts requests do expose the user's IP address to Google servers.

---

## 5. Privacy Risk Summary

| Category | Score | Notes |
|---|---|---|
| HTTPS & Transport Security | Good | Certificate valid; HSTS missing |
| Cookie Privacy | Excellent | No cookies at all |
| Tracker Exposure | Excellent | No analytics or tracking scripts |
| Security Headers | Good | CSP, X-Frame-Options, Permissions-Policy all present |
| Third-Party Exposure | Low Risk | Google Fonts exposes IP to Google |

Based on the performed checks, mithal.space does not appear to use tracking cookies or analytics services. The site has several security headers enabled, with HSTS being the main missing header.

---

## 6. Comparison to Two Other Sites

| Feature | mithal.space | DuckDuckGo (duckduckgo.com) | Google Search (google.com) |
|---|---|---|---|
| HTTPS | ✅ Yes | ✅ Yes | ✅ Yes |
| Third-Party Trackers | None detected | None | Uses Google-owned services and cookies that may be associated with personalization and advertising features |
| Cookies | ❌ None | Minimal (theme/settings only) | Multiple Google ecosystem cookies |
| Content-Security-Policy | ✅ Present | ✅ Strict | ✅ Present |
| Permissions-Policy | ✅ Present | ✅ Present | ✅ Present |
| HSTS | ❌ Missing | ✅ Full with preload | ✅ Full with preload |
| Data Sharing with 3rd Parties | Google Fonts (IP only) | None | Data collected may be used for personalization and targeting |
| Open Source | ✅ Yes (SearXNG) | ❌ No | ❌ No |

**Summary:** `mithal.space` is significantly more privacy-respecting than Google Search and comparable to DuckDuckGo. Its advantage over DuckDuckGo is being open-source and self-hosted on Ghaymah infrastructure. Its disadvantage is the missing HSTS header and Google Fonts dependency.

---

## 7. Three Security Improvements

### Improvement 1: Add HSTS Header
**Problem:** Without `Strict-Transport-Security`, browsers do not remember to always use HTTPS on the first visit, leaving a small window for SSL downgrade attacks.  
**Solution:**
```
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
```
Add to the Nginx or application server response headers. Then submit the domain to the [HSTS preload list](https://hstspreload.org).  
**Benefit:** Forces all future connections to use HTTPS from the first visit.

### Improvement 2: Self-Host Web Fonts
**Problem:** `fonts.googleapis.com` and `fonts.gstatic.com` requests expose the user's IP address to Google, even if no tracking cookies are set.  
**Solution:** Download the required fonts and serve them directly from `mithal.space`:
```nginx
location /fonts/ {
    alias /var/www/fonts/;
    add_header Cache-Control "public, max-age=31536000";
}
```
Update the CSP to remove `googleapis.com` and `gstatic.com` from allowed sources.  
**Benefit:** Eliminates all third-party IP exposure to Google.

### Improvement 3: Tighten CSP to Remove `'unsafe-inline'`
**Problem:** The current CSP allows `'unsafe-inline'` for scripts and styles. This weakens protection against XSS attacks.  
**Solution:** Replace inline styles/scripts with external files and use CSP nonces for any remaining inline code:
```
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self'; ...
```
**Benefit:** Significantly reduces the attack surface for cross-site scripting.

---

## Screenshots

![mithal.space homepage](screenshots/homepage.png)

![SSL certificate verified via crt.sh](screenshots/https-certificate.png)

![Search results page](screenshots/search-results.png)

> Additional DevTools screenshots (Cookies panel empty, Response Headers, Network requests) can be captured manually in Chrome/Firefox via F12 and saved to the `screenshots/` folder.