Our approach
- All traffic is served over HTTPS with modern TLS and HSTS.
- Access to production systems is limited, logged and protected by multi-factor authentication.
- Dependencies are monitored and patched regularly.
- Data is backed up and backups are tested.
- We collect the minimum personal data needed and encrypt sensitive data at rest.
Reporting a vulnerability
Email [email protected] with a description of the issue, the affected URL or product, steps to reproduce and the potential impact. Our machine-readable contact details are published at /.well-known/security.txt.
Scope
In scope: tenacy.ng and its subdomains, and products operated by Tenacy, including Librarie.
Out of scope: client websites we built but do not operate (report those to the site owner), denial-of-service testing, social engineering, physical attacks and issues in third-party services.
Rules of engagement
- Do not access, modify or delete data that is not yours. Use test accounts where possible.
- Do not degrade service for other users.
- Give us reasonable time to fix the issue before any public disclosure.
- Do not demand payment in exchange for disclosure.
Safe harbour
If you act in good faith and follow this policy, we will not pursue legal action against you for your research, and we will work with you to understand and resolve the issue.
What to expect
- Acknowledgement within 3 business days.
- An initial assessment within 10 business days.
- Updates as we work on a fix, and credit when it is resolved if you would like it.