Security

Last updated 23 October 2026

How this website is protected

• HTTPS only. Every page is served over an encrypted connection.
• Static site. There's no login, database or admin panel on the website to attack, and we don't store your enquiries on it.
• Content Security Policy. Pages may only run our own scripts and load our own styles, fonts and images. This blocks injected scripts and unexpected third-party code.
• No trackers or third-party scripts. No analytics, ad tags or embedded social widgets. Fonts are self-hosted.
• Click-to-load map. Google Maps only loads in a sandboxed frame after you ask for it.
• Safer form. Enquiries are sent over HTTPS to our inbox via FormSubmit, with spam protection, length limits, and only image files up to 5 MB accepted.
• Safe external links. Links to other sites open without passing control of this page or unnecessary referrer information.

Protecting yourself from scams

Fake accounts sometimes copy tattoo studios to take deposits. To stay safe:

• Our official accounts are @blackcattattoo_lurgan and @girv.tattoo on Instagram, @girvtattoo on TikTok, and girvtattoos on Facebook. Our email is lukeszns@gmail.com.
• We'll never ask for your card number, PIN or bank passwords by message or email.
• We don't run "giveaways" that need a fee or your bank details.
• If you're unsure whether a message is really from us, contact us through one of the official channels above before paying anything.

Reporting a vulnerability

If you think you've found a security problem with this website or our enquiry form, please email lukeszns@gmail.com with "Security" in the subject line. Include:

• the page or feature affected
• what the problem is and what someone could do with it
• steps to reproduce it

We'll acknowledge your report within 5 working days and keep you updated while we fix it. We're a small studio and can't offer payment for reports, but we're very grateful and happy to thank you publicly if you'd like.

Please don't

• access, change or delete anyone else's information
• send large volumes of form submissions, spam, or anything that could disrupt the site or our inbox
• use social engineering or phishing against us or our clients
• test against 191 Hair and Beauty, GitHub, FormSubmit, Google or Meta systems — report issues with those services to them directly
• share details of the problem publicly until we've had a reasonable chance to fix it

If you act in good faith and follow these guidelines, we won't take legal action against you for your research.

security.txt

A machine-readable version of this contact information is published at /.well-known/security.txt, following RFC 9116.