Site security

The World Lounge uses a lightweight static website. We take practical steps to reduce accidental exposure and form misuse, while being clear that a static site cannot provide the same controls as a dedicated booking platform or secure application backend.

Current safeguards

• Required fields, email format checks, and adult/student age limits
• Browser-side validation before an enquiry is prepared
• No public user accounts, passwords, or payment processing
• Form details are not stored in a public website database
• Minimal collection of information needed for an initial enquiry
• Local theme preference only, with no advertising or analytics tracking
• HTTPS should be enabled and enforced by the production host

Email and data handling

Enquiries are passed to the contact email selected by the visitor's mail application. Email is not a replacement for a secure customer database, so do not send passwords, payment card numbers, identity documents, or detailed health information through these forms.

Recommended production controls

Before accepting bookings at scale, the service should add a secure server-side form endpoint with validation, CSRF protection, spam filtering, rate limiting, abuse monitoring, structured access controls, encrypted storage, automated backups, security headers, dependency updates, and a documented retention and deletion process. Payment details should be handled only by a reputable payment provider, never by these forms.

Reporting a concern

If you notice a broken link, unexpected form behaviour, exposed information, or another security concern, please contact info.theworldlounge@gmail.com with the page address and a description. Do not include passwords or private documents in your report.