Security
Security is treated as a design constraint, not a checklist added at the end. This page describes what is actually implemented in this platform today, and is updated as controls change — it does not claim certifications or assessments that have not been completed.
Secure SDLC
How code changes reach production.
- • TypeScript with strict mode across the codebase
- • Automated lint, type-check and test gates in CI before merge
- • Dependency vulnerability scanning as part of the build pipeline
- • No secrets committed to source control; environment-variable-based configuration only
Identity & access
How authentication and authorization are structured.
- • Role-based access model: PUBLIC, INVESTOR, ADMIN
- • Server-side authorization checks on every protected route and API handler, not just route-level gating
- • Session cookies issued as HttpOnly, Secure and SameSite=Lax
- • Passwords, where used, are hashed (never stored in plaintext)
Data protection
How data in transit and at rest is protected.
- • HTTPS assumed and enforced at the deployment layer
- • Confidential investor documents gated by server-side role checks, not client-side hiding alone
- • No sensitive data written to browser localStorage
- • Least-privilege access patterns for any third-party data connectors described on product pages
Application security controls
Controls implemented directly in this platform.
- • Security response headers on every route: Content-Security-Policy, X-Frame-Options + frame-ancestors 'none' (clickjacking), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS
- • The CSP's script-src currently allows 'unsafe-inline' rather than per-request nonces — a deliberate tradeoff to keep static generation for the marketing pages, not an oversight. frame-ancestors, object-src and form-action are enforced without exception
- • Server-side input validation with Zod on every form and API endpoint
- • Output encoding via React's default escaping (no unsanitized dangerouslySetInnerHTML)
- • Rate limiting on public-facing form submission endpoints
- • CSRF-aware handling for state-changing requests
Monitoring, logging & incident response
How activity is observed and how incidents are handled.
- • Audit logging of admin actions and investor document access
- • No independent third-party security assessment has been completed yet; this is on the compliance roadmap
- • Security contact below for responsible disclosure of any issue found
Compliance roadmap
- • Commission an independent security assessment ahead of the first paid enterprise pilot.
- • Formalize an incident response runbook and publish a summarized version here.
- • Evaluate SOC 2 readiness once commercial traction justifies the investment.
No certification (SOC 2, ISO 27001 or otherwise) is currently held. This roadmap will be updated as work progresses, not before.
Responsible disclosure
If you believe you have found a security vulnerability in this platform, please report it to the security contact below with enough detail to reproduce the issue. Please do not publicly disclose a vulnerability before it has been addressed. No bug bounty program exists at this time.
Security contact: security@malcibux.com