ghaymah-exam-mahmoud-secops/q3-privacy-assessment/privacy-report.md

Privacy Assessment Report — mithal.space

mithal.space is a privacy-focused search engine built on SearXNG, hosted on Ghaymah infrastructure.

---

1. HTTPS & Certificate

Check	Result
HTTPS enforced	✅ Yes — HTTP redirects to HTTPS
TLS Version	TLS 1.2 / 1.3
Certificate Issuer	Let's Encrypt (intermediate: YR1)
Certificate Valid	✅ Yes (valid 2026-06-17 → 2026-09-15)
HSTS Header	❌ Not observed — missing Strict-Transport-Security

Finding: The site correctly enforces HTTPS with a valid Let's Encrypt certificate. The absence of HSTS means browsers will not remember to always use HTTPS on the first visit, leaving a narrow window for SSL-stripping attacks.

Screenshot: screenshots/https-certificate.png

---

2. HTTP Security Headers

Inspected via DevTools → Network → Response Headers on the main document request:

Header	Present	Observed Value
Content-Security-Policy	✅ Yes	default-src 'self'; script-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.gstatic.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: http:; connect-src 'self' [ghaymah internal services]; frame-ancestors 'none';
X-Frame-Options	✅ Yes	DENY
X-Content-Type-Options	✅ Yes	nosniff
X-XSS-Protection	✅ Yes	1; mode=block
Referrer-Policy	✅ Yes	strict-origin-when-cross-origin
Permissions-Policy	✅ Yes	geolocation=(), microphone=(), camera=()
Strict-Transport-Security	❌ Missing	Not present in any observed response

Finding: Security headers are well-configured overall. The CSP policy allows 'unsafe-inline' for scripts and styles (necessary for SearXNG), which slightly weakens XSS protection. HSTS is the main missing control.

---

3. Cookies

Inspected via DevTools → Application → Cookies → https://mithal.space:

No cookies were observed.

The site sets no tracking, session, or analytics cookies. This is consistent with a privacy-focused search engine — user state is not persisted between sessions.

---

4. Third-Party Network Requests

Inspected via DevTools → Network tab, filtering for third-party domains:

Domain	Purpose	Privacy Risk
fonts.googleapis.com	Google Fonts CSS	Low — IP address may be logged by Google
fonts.gstatic.com	Google Fonts files	Low — same as above
t0/t1/t2.gstatic.com	Search result favicons	Low — loaded only for displayed results
img.youtube.com	Video thumbnails in results	Low — loaded only when results include videos

Finding: No behavioral tracking services (e.g., Google Analytics, Facebook Pixel, or similar) were detected. The only third-party connections are to Google for web fonts and result thumbnails — both are functional rather than tracking in nature. However, Google Fonts requests do expose the user's IP address to Google servers.

---

5. Privacy Risk Summary

Category	Score	Notes
HTTPS & Transport Security	Good	Certificate valid; HSTS missing
Cookie Privacy	Excellent	No cookies at all
Tracker Exposure	Excellent	No analytics or tracking scripts
Security Headers	Good	CSP, X-Frame-Options, Permissions-Policy all present
Third-Party Exposure	Low Risk	Google Fonts exposes IP to Google

Based on the performed checks, mithal.space does not appear to use tracking cookies or analytics services. The site has several security headers enabled, with HSTS being the main missing header.

---

6. Comparison to Two Other Sites

Feature	mithal.space	DuckDuckGo (duckduckgo.com)	Google Search (google.com)
HTTPS	✅ Yes	✅ Yes	✅ Yes
Third-Party Trackers	None detected	None	Uses Google-owned services and cookies that may be associated with personalization and advertising features
Cookies	❌ None	Minimal (theme/settings only)	Multiple Google ecosystem cookies
Content-Security-Policy	✅ Present	✅ Strict	✅ Present
Permissions-Policy	✅ Present	✅ Present	✅ Present
HSTS	❌ Missing	✅ Full with preload	✅ Full with preload
Data Sharing with 3rd Parties	Google Fonts (IP only)	None	Data collected may be used for personalization and targeting
Open Source	✅ Yes (SearXNG)	❌ No	❌ No

Summary: mithal.space is significantly more privacy-respecting than Google Search and comparable to DuckDuckGo. Its advantage over DuckDuckGo is being open-source and self-hosted on Ghaymah infrastructure. Its disadvantage is the missing HSTS header and Google Fonts dependency.

---

7. Three Security Improvements

Improvement 1: Add HSTS Header

Problem: Without Strict-Transport-Security, browsers do not remember to always use HTTPS on the first visit, leaving a small window for SSL downgrade attacks.
Solution:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Add to the Nginx or application server response headers. Then submit the domain to the HSTS preload list.
Benefit: Forces all future connections to use HTTPS from the first visit.

Improvement 2: Self-Host Web Fonts

Problem: fonts.googleapis.com and fonts.gstatic.com requests expose the user's IP address to Google, even if no tracking cookies are set.
Solution: Download the required fonts and serve them directly from mithal.space:

location /fonts/ {
    alias /var/www/fonts/;
    add_header Cache-Control "public, max-age=31536000";
}

Update the CSP to remove googleapis.com and gstatic.com from allowed sources.
Benefit: Eliminates all third-party IP exposure to Google.

Improvement 3: Tighten CSP to Remove 'unsafe-inline'

Problem: The current CSP allows 'unsafe-inline' for scripts and styles. This weakens protection against XSS attacks.
Solution: Replace inline styles/scripts with external files and use CSP nonces for any remaining inline code:

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self'; ...

Benefit: Significantly reduces the attack surface for cross-site scripting.

---

Screenshots

Additional DevTools screenshots (Cookies panel empty, Response Headers, Network requests) can be captured manually in Chrome/Firefox via F12 and saved to the screenshots/ folder.