Security
How we protect aadhyay.com and how to report a vulnerability responsibly.
Draft pending legal review. This document is a working template and has not yet been reviewed by the company’s owners or legal advisers. It will be updated before it is relied on.
How the website is protected
- HTTPS everywhere with HSTS
- Content Security Policy and hardened HTTP headers
- Server-side validation of all input and safe rendering of editor content
- Rate limiting and spam protection on forms
- Administrator accounts with strong passwords, two-factor authentication and audited actions
- Private database and cache networks; secrets kept out of source code
- Encrypted, off-site backups
Reporting a vulnerability
Please report suspected vulnerabilities through the contact form with "Security report" in the message, including steps to reproduce. Do not access or modify data that is not yours, do not degrade the service, and give us reasonable time to fix the issue before disclosure.
Out of scope
- Denial-of-service testing
- Social engineering of staff
- Findings that require physical access to a device
Questions about this document? Contact us.