Legal
Security
Our approach to website security and how to report a potential vulnerability.
Template notice: this page is a starting template and must be reviewed and completed by the company and its legal counsel before publication.
Website security practices
- HTTPS with strict transport security in production.
- A restrictive Content Security Policy and hardened HTTP security headers.
- Server-side validation and sanitization of all form input.
- Secrets are stored in environment configuration, never in source code or the browser.
- Dependencies are kept current and checked in continuous integration.
Reporting a vulnerability
If you believe you have found a security issue affecting this website, please contact us through the contact page and select “Other” as the area of interest. Please do not include exploit details or sensitive data in the initial message; we will follow up with a secure channel.
Please act in good faith: avoid accessing data that is not yours, degrading service availability, or publicly disclosing an issue before it has been addressed.