SECURITY AUDIT PROOF - hosting arbitrary content on gov domain