Legal
Security Policy
This describes what's actually implemented on this site today, not a certification or a compliance claim. We're not SOC 2, ISO 27001, or PCI-DSS certified, because this site doesn't process payments and hasn't gone through that audit.
What we do
- • The admin password is never stored in plaintext; it's hashed with bcrypt before it touches disk or a database.
- • Admin sessions use a signed, expiring token, checked with a constant-time comparison so response timing can't leak information about a guessed value.
- • Admin login is rate-limited and temporarily locks out after repeated failed attempts.
- • Every form on this site validates and whitelists its input shape on the server, not just in the browser.
- • We collect only what you actively submit through the contact or data-rights forms; see our Privacy Notice for the full detail.
Reporting a vulnerability
If you've found a genuine security issue with this site, please email hello@zenithdynamics.in with enough detail to reproduce it. Please don't test against real visitor data, don't attempt to access accounts that aren't yours, and give us a reasonable window to fix an issue before disclosing it publicly.
A machine-readable version of this contact is available at /.well-known/security.txt, per RFC 9116.