Security

How we secure our systems

• Encryption. All traffic to our sites and services is served over TLS with HSTS. Data at rest is encrypted by our infrastructure providers.
• Access control. Administrative access follows least privilege, requires multi-factor authentication, and is reviewed when someone’s role changes.
• Managed infrastructure. We prefer managed platforms over self-run servers so that patching and hardening are handled by teams who do it full time.
• Dependency hygiene. Dependencies are kept current and monitored for known vulnerabilities; security patches are prioritized over feature work.
• Minimal attack surface. This website is static, ships no third-party scripts, and enforces a strict Content Security Policy. Fewer moving parts, fewer things to compromise.
• Client data. During consulting engagements we work in the client’s environment wherever possible, avoid copying production data, and return or destroy client material at the end of the engagement.

Reporting a vulnerability

If you have found a security issue in our website, our applications, or our infrastructure, please tell us at security@gunjaconsulting.com. We read every report.

A useful report includes:

• the affected URL, application, and version;
• a clear description of the issue and its impact;
• the steps needed to reproduce it; and
• any proof-of-concept output, logs, or screenshots.

Please report in English if you can, and give us a way to reach you for follow-up questions.

What we commit to

• We acknowledge your report within 2 business days.
• We give you an assessment and a remediation timeline within 10 business days.
• We keep you updated while we work on a fix.
• We will not pursue or support legal action against you for good-faith research that follows the guidelines below.
• We are happy to credit you publicly when the issue is resolved, if you want that. We do not currently offer monetary bounties.

Research guidelines

To stay within good-faith research, please do:

• test only against accounts and data you own or have permission to access;
• stop as soon as you have confirmed a vulnerability exists — proof of concept, not exploitation;
• give us a reasonable opportunity to fix the issue before disclosing it publicly (90 days is our default expectation, and we are happy to discuss);
• delete any data you incidentally obtained once you have reported it.

Please do not:

• access, modify, or delete data belonging to anyone other than yourself;
• run denial-of-service, volumetric, or load tests against our systems;
• use social engineering, phishing, or physical intrusion against our staff, our clients, or our providers;
• install malware or persistence of any kind, or pivot into other systems; or
• demand payment in exchange for withholding a report — that is extortion, not research, and we treat it accordingly.

Out of scope

The following are generally not considered actionable on their own, though we will still read a report that explains a real-world impact:

• missing best-practice headers on pages with no sensitive content;
• reports from automated scanners without a demonstrated exploit;
• issues that require a rooted or jailbroken device, a compromised account, or physical access to an unlocked device;
• social engineering of our staff or users, and self-XSS;
• email configuration findings (SPF, DKIM, DMARC) unless you can demonstrate practical spoofing; and
• vulnerabilities in third-party services we do not control — please report those to the vendor.

Systems belonging to our consulting clients are out of scope. We cannot authorize testing against infrastructure we do not own. Report those directly to the organization concerned.