We practice what we teach.
A foundation that talks about quantum-safe security should show its own. These are the measures that actually protect this website today, and the limits we are open about.
Last checked 24 October 2026.
Post-quantum encryption
Connections to this website use hybrid post-quantum key agreement, X25519MLKEM768. It combines the classical X25519 method with ML-KEM, the NIST post-quantum standard FIPS 203. Traffic is protected even against someone who records it today and tries to decrypt it later with a quantum computer.
It works whenever your browser supports it, which current Chrome, Edge and Firefox do. Older browsers fall back to classical encryption.
We confirmed this with Cloudflare Radar's post-quantum test on 24 October 2026.
HTTPS and certificates
- Encrypted only. Every page is served over HTTPS with TLS 1.3. Your browser is told to always use HTTPS for this site (HSTS), so it never falls back to an unencrypted connection.
- Managed certificates. Certificates are issued and renewed automatically by our host, so they do not expire unnoticed.
DDoS protection
The website runs on Cloudflare's global network. Cloudflare includes unmetered protection against distributed denial-of-service (DDoS) attacks, both at the network level (layers 3 and 4) and against floods of web requests (layer 7). Attacks are detected and filtered before they reach the site.
Because the pages are served from many locations worldwide, a spike in visitors during Quantum Week does not overload a single server.
A small attack surface
- No PHP or server codeThe site is static pages only. Attacks on server software, plugins or admin panels have nothing to target.
- No databaseThere is no stored visitor data to steal and nothing to inject into.
- No logins or formsNo passwords to guess and no input fields to abuse.
- No cookies or trackingNo analytics, no advertising trackers, no session cookies.
- No third-party scriptsAll program code comes from this site itself. Only the typefaces load from Google Fonts.
Browser protections
Every page sends standard security instructions to your browser:
- Content Security Policy
- Only code and content from this site, plus Google's font files, may load. Injected scripts from anywhere else are blocked.
- No framing
- Other websites cannot embed these pages, which prevents click-jacking tricks.
- Strict HTTPS (HSTS)
- Browsers remember to connect over HTTPS only.
- No content sniffing
- Browsers must treat each file as the type it is declared to be.
- Referrer policy
- Links to other sites only share our domain name, never the full page address.
- Permissions policy
- Camera, microphone, location, payment and USB access are switched off for this site.
Limits we are open about
- Certificates are still classical. Website certificates and signatures across the whole internet still use classical cryptography. Post-quantum certificates are expected from 2026 to 2027.
- This page covers this website only. It says nothing about the foundation's email or other systems.
- Google Fonts is served under Google's own security settings, not ours.
- Links leave our protection. Ticket sales on tickets.cw and other linked sites follow their own security.
Check it yourself
Enter this site's domain at radar.cloudflare.com/post-quantum, or open your browser's security details for this page. The same test works for your own website; read what a result does and does not mean first.
Report a problem
Found a security issue on this website? Write to info@quantumcuracao.com. Please describe what you found and how to reproduce it, and give us reasonable time to fix it before sharing it publicly.