Security

Reporting a vulnerability

If you have found a security issue in this website or the portal, email us. Tell us what you found and how to reproduce it. We will acknowledge within two business days.

We will not pursue legal action against anyone who reports a genuine issue in good faith, gives us reasonable time to fix it, and does not access, modify or delete data belonging to anyone else while investigating.

What is in scope for that

This website and the customer portal. Not our customers' systems, not the systems we test, and not third party services we use.

How the portal is built

Identity is handled by Clerk. Every portal request is authorized on the server against the verified session token, and ownership of every record is derived from that token rather than from anything the client sends.

Report files are not addressable by a public URL. Each retrieval checks ownership on the server first.

Administrative access is granted by an explicit record in the database, not by a role claim in a token, so it can be revoked without a change to the identity provider.