Security at StackOrcs

• Minimize data collection and system exposure.
• Use least privilege for people, services, and automation.
• Keep dependencies and platforms current and supported.
• Make important activity observable and reviewable.
• Plan for failure, recovery, and responsible disclosure.

The public site minimizes backend surface area. Inquiry and newsletter routes validate input, restrict same-origin requests, apply rate limits, and keep provider credentials server-side. The admin broadcast route requires a timing-safe secret comparison. No visitor account or advertising tracker is required.

Client delivery practices are tailored to system risk and may include threat modeling, protected branches, code review, dependency controls, secret management, automated testing, environment separation, logging, and incident runbooks.

Security is shared. Exact responsibilities, controls, access, and response procedures should be defined for each engagement and reflected in the relevant contract and architecture.

If you believe you have found a security issue, contact StackOrcs privately with enough detail to reproduce and evaluate it. Do not access data that is not yours, degrade service, or publicly disclose an unresolved issue.

This page describes principles and intended practices. It does not claim a certification, audit result, or compliance status unless that is separately stated in a current, verifiable document.