Security
We hack our own stuff before you do. If you find something first, we pay you.Report a vulnerability to [email protected]. We acknowledge within two business days and we pay for valid findings.
Report a vulnerability to [email protected]. We acknowledge within two business days, we do not threaten researchers acting in good faith, and we pay for valid findings through the public bounty board. The machine-readable policy is at /.well-known/security.txt.
Reporting a vulnerability
Email [email protected] with enough detail to reproduce. A proof of concept helps; a scanner screenshot usually does not.
We will acknowledge within two business days, tell you what we think it is, and keep you updated until it is fixed. We will credit you publicly unless you would rather we did not.
Safe harbour
Research conducted in good faith under this policy is authorised, and we will not pursue or support legal action over it.
Good faith means: only against our own systems, no accessing or modifying data that is not yours, no degrading service for other people, no social engineering of our staff or customers, and giving us reasonable time to fix before publishing.
Scope
- cognitive-industries.org and its subdomains
- api.cognitive-industries.org
- The products listed under products, on their own domains
- Our public repositories under github.com/CogForgeLabs
Out of scope: third-party services we merely use, findings that require a compromised device or physical access, missing headers with no demonstrated impact, and automated scanner output with no exploit path.
Rewards
We run a public bounty board. Valid findings are paid, listed, and the debt is shown publicly until it is settled. Submit through the bounty board on the homepage.
Transport
HTTPS everywhere, TLS 1.2 minimum with TLS 1.3 preferred, HSTS with a one-year max-age, includeSubDomains and preload. HTTP is redirected, never served.
Browser security headers
Content-Security-Policy restricting scripts, styles, fonts, connections and frames to an explicit allow-list. X-Content-Type-Options: nosniff. Referrer-Policy: strict-origin-when-cross-origin. X-Frame-Options: DENY and frame-ancestors none. Permissions-Policy denying the sensor and payment APIs the site does not use. Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy set to isolate the origin.
Secrets
No secret is committed. Runtime secrets are Cloudflare Worker secrets, injected at the edge and never readable from a deployment log. The repository is scanned for accidentally committed credentials on every push.
Data
Encrypted in transit by TLS and at rest by the storage platform. Personal information collected through the site is limited to what a form genuinely needs, retained on a stated schedule, and deleted on request.
Disclosure
Report a vulnerability to [email protected]. The machine-readable policy is at /.well-known/security.txt. We acknowledge within two business days, we do not threaten researchers who act in good faith, and we pay for findings through the public bounty board.
Security questions we get asked
How do I report a security vulnerability?
Email [email protected], or follow the machine-readable policy at /.well-known/security.txt. We run a bounty board and we pay for findings.
What data does this website collect?
First-party analytics only: page views, referrer, campaign parameters, coarse device class and performance timings, with no cookies used for advertising and no personal information in event payloads. The full detail is in the privacy policy and the cookie policy.
Do you sell or share data?
No. Directive 02: your data is yours. We do not sell it, mine it, or anonymise it into a product.
How do I request my data or have it deleted?
Email [email protected] from the address the data relates to. The process and the timelines are set out on the data requests page.
Is the site covered by the Privacy Act 1988?
We handle personal information in line with the Australian Privacy Principles regardless of turnover thresholds, because the alternative is deciding which of your customers deserve the protections.
Sources
Where this page states a standard, an obligation or a research result, this is what it is drawn from. All external, all checkable.
- RFC 9116 — A File Format to Aid in Security Vulnerability Disclosure — the security.txt standard
- OWASP Top 10 — the risk categories the review covers
- OWASP Application Security Verification Standard — the checklist a review is measured against
- Content Security Policy Level 3 — W3C
- RFC 6797 — HTTP Strict Transport Security — IETF
- SARIF 2.1.0 — OASIS — the format Unslop emits
Last reviewed · Site changelog