Trust & Launch Readiness
Secure.
Discoverable.
Ship-ready.
A live snapshot of the security and discoverability measures already built into The Song Room.
Security
Protections in placeEncrypted connection
Every page loads over HTTPS, enforced site-wide so the connection can't be downgraded.
Hardened browser headers
Protections against clickjacking, content-sniffing and referrer leakage on every response.
Content Security Policy
A policy governs what's allowed to run on the page, and it's actively monitored.
Row-level database security
Access is enforced row by row, so people only ever reach their own songs and data.
Server-verified access
Sign-in and permissions are checked on the server, never trusted from the browser.
Google sign-in
Accounts use Google authentication, so The Song Room never sees or stores your password.
Encryption at rest
Uploaded audio and account data are encrypted where they're stored.
Server-only secrets
Keys and credentials stay on the server and are never shipped to the browser.
Injection protection
User content is escaped and database queries are parameterised to block injection attacks.
Continuous dependency scanning
Third-party code is scanned automatically and patched as security fixes ship.
Abuse protection on public forms
Public inputs are rate-limited and spam-guarded.
Cookie consent
Non-essential tracking only runs after you agree.
Discoverability & SEO
In placerobots.txt
Clear crawl rules tell search engines what to index.
XML sitemap
A full sitemap helps search engines find every page.
Page titles & descriptions
Every page carries purpose-written search metadata.
Social share cards
Links unfurl into rich previews when shared on social and in messages.
Favicon & app icons
Proper icons across browsers, tabs and devices.
Custom 404 page
A branded, helpful page when something can't be found.
Mobile-first & responsive
Designed for the phone first, scaling cleanly up to desktop.
Canonical URLs
One clear address per page, so search ranking isn't split.
Privacy Policy & Terms
Both published and linked from the site footer.
Accessibility checks in CI
Automated accessibility tests run on every change before it ships.
Consent-gated analytics
Usage analytics that only run once you've given consent.