Security & Responsible Disclosure

1. Reporting a vulnerability

Please include, where you can:

• the affected URL, endpoint or component;
• a description of the issue and its potential impact;
• step-by-step reproduction instructions or a minimal proof of concept;
• your name or handle if you would like to be credited.

We do not currently operate a paid bug-bounty programme. We do credit reporters, with their permission, once an issue is resolved.

2. What to expect from us

• Acknowledgement within 3 business days.
• Triage and severity assessment within 10 business days, with a point of contact for follow-up.
• Remediation targeted within 90 days of triage for confirmed issues; critical issues are prioritised.
• Coordinated disclosure. We ask that you give us the opportunity to fix an issue before publishing details; we will agree a disclosure date with you.

3. Scope

In scope

• enricx.com and www.enricx.com (this website);
• the contact-form API that this website calls;
• other *.enricx.com hosts that are publicly reachable.

Out of scope

• the underlying infrastructure of our providers (AWS, Cloudflare, Google) — report those to the provider;
• denial-of-service, volumetric or resource-exhaustion testing of any kind;
• social engineering, phishing or physical attacks against our people or premises;
• spam, or findings that require a victim to be tricked into unlikely actions;
• output of automated scanners without a demonstrated, exploitable impact;
• missing best-practice headers, version disclosure or similar findings with no security impact;
• clickjacking on pages with no sensitive actions.

4. Rules of engagement

While researching, you must:

• only access data that belongs to you, or test accounts you control — never other people’s enquiries or personal data;
• stop as soon as you have enough evidence to demonstrate the issue, and do not exfiltrate, modify or destroy data;
• keep testing volume low — the contact form sends real emails and stores real records;
• not use a finding to pivot into other systems;
• not publicly disclose the issue before we have resolved it or agreed a disclosure date.

5. Safe harbour

If you make a good-faith effort to comply with this policy, we will consider your research authorised, will not pursue or support legal action against you in relation to it, and will work with you to understand and resolve the issue quickly. This authorisation is limited to the scope above and does not extend to third-party systems.

6. How this site is protected

• Transport: HTTPS only, with HTTP Strict Transport Security (2 years, includeSubDomains, preload).
• Browser hardening: a strict Content Security Policy (no inline or third-party scripts other than Cloudflare Turnstile), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, a restrictive Referrer-Policy and Permissions-Policy.
• Contact form: Cloudflare Turnstile verified server-side on every request, a honeypot field, and server-side validation and sanitisation of every field (length limits, email format, an allow-list for product selection, business-email-only policy).
• API: CORS locked to our own origins; HTTPS-only API; serverless handlers with least-privilege access scoped to a single data store and a single email identity; secrets held in an encrypted secrets store, never in code or environment variables; a web application firewall (managed rule sets plus per-IP rate limiting) in front of the API.
• Data: encrypted at rest and in transit; retention limits described in the Privacy Policy.
• Dependencies: routine npm audit reviews; high and critical findings are fixed before release.

7. Contact

Security: security@enricx.com
Privacy: privacy@enricx.com
security.txt: https://enricx.com/.well-known/security.txt