Security Standards & Disclosure

Enterprise security controls, encryption architecture, and responsible disclosure program.

1. Security Architecture & Isolation

sitelinks is engineered with defense-in-depth security principles. Edge redirect processing is strictly isolated from user administrative surfaces. Database access uses least-privilege role separation, and workloads execute in secure, containerized environments.

2. Encryption in Transit & at Rest

  • In Transit: All web traffic is strictly encrypted using TLS 1.3 / HTTPS. We enforce HTTP Strict Transport Security (HSTS) with max-age=63072000; includeSubDomains; preload.
  • Passwords: Authentication secrets are hashed with salted PBKDF2-HMAC-SHA256 using 100,000 iterations. We never store or log plaintext passwords.
  • Payment Data: We do not handle, store, or process raw credit card numbers. All billing is tokenized via PCI-DSS Level 1 compliant payment gateways.

3. Network & Infrastructure Protection

  • DDoS Shielding: Automated edge mitigation protects against Layer 3/4 and Layer 7 distributed denial-of-service attacks.
  • Rate Limiting: Sensitive endpoints (login, password reset, sign-up) are guarded with multi-tier IP and account-level throttling to prevent brute-force attacks.
  • Security Headers: We enforce Content-Security-Policy (CSP), Permissions-Policy, Cross-Origin-Opener-Policy (COOP), Cross-Origin-Resource-Policy (CORP), and X-Frame-Options: DENY.

4. Responsible Vulnerability Disclosure (RFC 9116)

We welcome responsible security research. If you discover a vulnerability, please report it to our security team:

5. Safe Harbor Commitment

We will not pursue legal action against security researchers who conduct good-faith research, refrain from accessing user data or disrupting production availability, and allow us reasonable time to remediate before public disclosure.