Security
How this site is built, and how to tell us if something is wrong.
A security firm's own site should be small, boring and easy to check. Here is what it is made of, what it does not do, and where to report a problem.
What the site is
Static HTML and CSS served over HTTPS by Cloudflare. There is no database, no content management system, no plugins, no logins and no server-side code, so there is very little to attack and nothing on it to steal. The contact form hands your message to your own mail app; it does not send data to this server.
Controls in place
- HTTPS only, with HSTS
- A strict Content Security Policy
- One third-party script, our live chat (tawk.to), allowed by name in the policy
- Framing blocked (clickjacking)
- MIME sniffing blocked
- Camera, microphone and location denied
- Referrer trimmed to our domain name
- Published security.txt contact
You do not have to take our word for it: check the response headers yourself, or run the site through a public header scanner.
Reporting a vulnerability
If you think you have found a security problem with this site or our email, write to info@veritymsc.com with the subject "Security report". Tell us what you found, how to reproduce it, and how to reach you. We will acknowledge it within three business days and tell you what we are doing about it.
If you act in good faith, stay within the site, avoid accessing or changing anyone else's data, avoid degrading the service, and give us reasonable time to fix the issue before telling anyone else, we will not pursue or support legal action against you. We do not run a paid bug bounty.
Sending us sensitive information
Email is not the place for patient information, passwords or security findings that include live credentials. Ask, and we will send you a secure link to upload through.
Our own program
We are building our own firm to the standard we set for clients: a written information security program, a risk analysis of our own firm, an incident response plan, and tested backups. That evidence pack is in progress; prospective clients can ask for it once it is complete.