Security Model

What aestheticfonts.im protects, and where the boundary ends.

Architecture

aestheticfonts.im is delivered as a static website. Font conversion and symbol customization run in browser-side JavaScript; there is no generation API receiving the text. The production build emits a restrictive Content Security Policy that limits scripts, styles, images, fonts, and network connections to the site’s own origin, hashes for the exact inline code included in the build, and narrow allowlists for PageView, Microsoft Clarity, and Clarity’s Bing collection endpoint.

Response headers also deny framing, disable MIME-type sniffing, apply a strict referrer policy, and disable access to camera, microphone, geolocation, payment, and USB capabilities. These controls reduce common web attack paths but do not make any website immune to every threat.

Data lifecycle

Text is typed into the current page, transformed locally, and displayed in the same tab. Selecting a result asks the browser to copy that result to the clipboard. Generator text is not written to LocalStorage, a cookie, or a site account. Replacing the text, clearing it, reloading, or closing the tab removes it from the page state.

The optional color-theme choice may be kept in LocalStorage. PageView measures page views, while Microsoft Clarity analyzes rendering and interactions such as clicks, scrolling, and mouse movement. The font generator and symbol library use data-clarity-mask="true" so their contents are masked in Clarity recordings, and the site does not send generator text through custom analytics events. Normal hosting infrastructure may still create request and security logs; see the Privacy Policy for these separate layers.

Threats reduced

• Sending generator input to a remote text-conversion service
• Account takeover risk, because the site currently has no user accounts or passwords
• Unauthorized framing of the interface on another domain
• Unnecessary browser permissions and unrestricted third-party script connections

Threats not eliminated

• Compromised device or browser extension
• Look-alike domains
• Clipboard history, clipboard monitoring, or screen observation on the visitor’s device
• Unicode spoofing or confusing characters chosen by a visitor
• Browser, hosting, dependency, or future software supply-chain vulnerabilities
• Changes made by a third-party platform after text leaves this site

Always confirm that the address bar shows aestheticfonts.im before using the tool. Never enter a password, recovery phrase, private key, payment card, or another secret into a decorative text generator.

Reporting

To report a suspected vulnerability privately, email hello@aestheticfonts.im with “Security” in the subject. Include the affected URL, a concise description, reproducible steps, and the browser or device involved. Do not include real secrets, personal data, destructive payloads, or data belonging to another person.

Please allow reasonable time to investigate before public disclosure. We welcome good-faith reports, but this page does not authorize access to other people’s data, service disruption, social engineering, physical testing, or destructive security testing.