Security is not a plugin installed at the end. It starts in the data model and the contact form.
For every site: XSS and injection resistance, CSRF on cookie sessions, rate limits on public endpoints, secret and dependency scanning, and headers that actually constrain the browser.
This Aizen site is built on those rules — a sample, not a slogan.