Security
What we do, stated in a form you can check yourself rather than a badge you have to take our word for.
The calculations never leave your browser
Every calculator here is a pure function running on your device. Your dimensions, your prices and your results are never transmitted, never logged and never stored on a server — there is no server in that path at all. That is not a policy we could quietly change; it is what the code does, and it is why the site works with the network off.
Favourites, history and your unit preference live in your browser's local storage and are readable only by this site. Clearing site data removes them completely.
Response headers
Set on every response. Verify them yourself:
curl -sI https://roughestimator.com | grep -i -E 'content-security|strict-transport|x-frame|x-content|referrer|permissions'| Header | What it buys |
|---|---|
Content-Security-Policydefault-src 'self'; object-src 'none'; base-uri 'self' | Limits where scripts, styles, images and connections may come from. `object-src none` kills Flash/plugin vectors; `base-uri self` stops an injected <base> tag rewriting every relative URL on the page. |
Strict-Transport-Securitymax-age=31536000; includeSubDomains; preload | Browsers refuse plain HTTP to this domain for a year, including subdomains. Closes the first-request downgrade window. |
X-Content-Type-Optionsnosniff | Stops the browser second-guessing a declared Content-Type — the trick behind serving a script as an image. |
X-Frame-OptionsSAMEORIGIN | Prevents another site framing ours to capture clicks. Our own embeds are same-origin iframes and are unaffected. |
Referrer-Policystrict-origin-when-cross-origin | Outbound links carry our origin but never the full path, so a calculator URL with your dimensions in it is not leaked to third parties. |
Permissions-Policycamera=(self), microphone=(self), geolocation=(self), payment=() | Camera is self-only for the AR tape measure, microphone for voice input, geolocation for the weather window. Payment is disabled outright — this site takes no money. |
Reporting a vulnerability
Email [email protected] with steps to reproduce. We aim to acknowledge within 72 hours. Please give us a reasonable window to fix an issue before disclosing it publicly, and please do not run automated scans that degrade the service for other people — a proof of concept is plenty.
We do not currently run a paid bounty programme. We will credit you on this page if you would like us to.