AFSVP
Security
Effective September 21, 2026.
What we do
- HTTPS only. Plain-HTTP requests are redirected to HTTPS.
- Single-operator posture. The application is run and used by one operator. Operator status views are currently reachable without a login while access controls are being reworked; they expose no credentials, order controls, or personal data about visitors. The public site is static.
- Least privilege. Public hosts serve only the routes they need; internal services listen on localhost and are reached only through the reverse proxy.
- No secrets in frontend code. API keys, broker credentials, and webhook secrets live only on the server. The published frontend bundle was last checked for leaked secrets on September 21, 2026.
- Authenticated, rate-limited webhooks. Inbound alert traffic must carry a shared secret and is rate-limited per client.
- Logging and monitoring. Access logs, rejected requests, and system-health checks are monitored for abuse and errors.
- Paper/demo posture. The system currently operates in paper, demo, and observation modes. No public route places live orders.
We do not claim penetration testing, third-party audits, or any compliance certification. We do not run a bug bounty program.
Reporting a vulnerability
If you believe you have found a security issue, please report it privately. Do not open a public issue.
- GitHub private report: Report a vulnerability
- Machine-readable contact: /.well-known/security.txt
Include a description, the affected URL or component, reproduction steps that do not use real credentials, and the impact you believe it has. We will acknowledge reports as quickly as we can. There is no monetary reward.
Testing boundaries
Good-faith research against publicly reachable pages is welcome, within these limits. You do not have permission to:
- perform destructive actions or modify data;
- run denial-of-service, load, or stress testing;
- use social engineering, phishing, or physical attacks;
- touch broker, order, execution, or webhook paths, or send forged alert traffic;
- exfiltrate, retain, or publish data you were not meant to see — stop and report as soon as you realize you have access;
- attack third-party providers (hosting, GitHub, Google Fonts, Discord).
Activity outside these limits is a violation of the Terms and may be reported.