Document
Technical Manual
This is the technical manual for Otizm Dernekleri. It can be regarded as both a guide for users and NGOs who intend to use this website and a technical specification document.
Otizm Dernekleri serves this single function: It is the main index for autism NGOs in Turkey. A citizen of Turkey (or outside of Turkey) can search, find and learn about autism NGOs that appear on this page. They can search and find through location, purpose and scope.
This index can get people together in the future.
You can either just look around and see what citizens of Turkey are doing for the Autism Spectrum Cause, search a specific NGO by using our index and table functionality, or learn how you can be part of the solution.
You can contact us via business@erdemhanay.info, and we can set your organization up on Otizm Dernekleri together.
Keep it simple.
Why? Because a more complex system is unneeded and can cause issues (performance, upkeep, security).
- Framework
- Astro (Opens in a new tab)Built as a static website, with server islands (https://docs.astro.build/en/concepts/islands/ (Opens in a new tab)) added for RSS parsing.
- Hosting
- Cloudflare (Opens in a new tab)Sustainable and reliable, plus it has a good WAF.
- Domain registry
- Namecheap (Opens in a new tab)Industry standard (in the future a .gov subdomain could be registered and transferred through TRABİS (https://www.trabis.gov.tr/ (Opens in a new tab)) .gov is wanted).
- Analytics
- Cloudflare Web AnalyticsReliable and needs no cookie banner (less clutter).
Note
RSS feed styling and Astro server island structure compatibility (through RSS parsing) required extra care (in compliance with the NGOs' IT departments or equivalent parties).
We operate under WCAG rules (https://www.w3.org/WAI/standards-guidelines/wcag/ (Opens in a new tab)).
The main styling is kept as basic as possible, so the accessibility settings do not create a huge difference.
Risks
- An attacker could use this website to recon and index all the autism NGOs, but they can already do that with the technology they have.
- DDoS could be an issue.
- Someone could poison an RSS feed of one of the websites that we query. We have no control over that legally, but we needed to protect ourselves regardless.
Measures
- No API leakage risk (literally no traditional API exists).
- Zero information that is not already publicly available is served on the website.
- Cloudflare WAF protects against DDoS.
- HTTPS is enforced for every RSS feed.
- A server-side RSS sanitizer prevents escape characters (industry standard).
- Timeout and data size rules (5 seconds, 256 KB) limit every feed request.
- Strength: A static build with lightweight JavaScript functionality (which is pretty fast).
- Trade-off: Server islands make a GET request, parse the XML, and style it (low effect though).
- Strength: Lazy loading is utilized, so the user only gets the necessary assets.
We are under KVKK (https://www.kvkk.gov.tr/ (Opens in a new tab)) and GDPR (https://gdpr-info.eu/ (Opens in a new tab)) respectively.
- The site only collects analytics data, and this is mentioned.
- Google Maps is only loaded after the visitor gives consent.
- Fonts are self-hosted, so no request goes to Google Fonts.
- So there is not a lot to worry about here either.
- We use i18n.
- There is no need to translate every incoming RSS feed item, because the main aim of internationalization is international prestige.
- In the future, if deemed needed, we can simply filter the RSS feed for the language the client chose.
Thank you for your attention.
ERDEM HANAY
© 2026 ERDEM HANAY