How We Secure Our Own Platform

We're a security company, so we hold ourselves to the standard we sell. This page lists what we actually do today, what's in progress, and how to report a vulnerability to us. No badges we haven't earned.

Current Practices

Encryption in transit

All traffic to cybersharcx.in is served over TLS with HSTS enforced, so browsers refuse to connect insecurely.

Password security

Passwords are hashed with bcrypt (cost 12) — never stored or logged in plaintext. Password resets use single-use, hashed, 15-minute tokens.

Role-based access control

Administrative functions require an authenticated admin session, verified server-side on every request — plus an audit log of every admin action.

Rate limiting

Authentication and form endpoints are rate-limited to blunt credential-stuffing and abuse.

Hardened HTTP headers

Strict Content-Security-Policy, HSTS, frame-ancestors 'none', nosniff, Referrer-Policy, and Permissions-Policy on every response.

A user-space agent, never control

Our monitoring agent runs in user space and observes. It never takes control of customer infrastructure and never enforces changes automatically.

In Progress — Not Yet Achieved

We list these separately because they are commitments, not credentials. We will move them above only when they are done:

  • SOC 2 / ISO 27001 readiness work — building the control set and documentation
  • An external penetration test of the platform by an independent firm

Responsible Disclosure

Found a vulnerability in cybersharcx.in or our platform? We want to hear about it — directly from you, before anyone else.

  • Email contact@cybersharcx.in with reproduction steps. Our machine-readable contact is published at /.well-known/security.txt.
  • We acknowledge reports within 48 hours and keep you updated until resolution.
  • We will not pursue legal action against good-faith security research that avoids privacy violations, data destruction, and service disruption.
  • We don't run a paid bug bounty yet — we say so plainly rather than imply one. We credit researchers who want to be credited.