Security is a continuous engineering responsibility, not an absolute promise. Our approach considers access, credentials, dependencies, backups, deployment, monitoring, and clear incident communication.
Prevent · Prepare · Respond
View controlsThe controls applicable to a project depend on its scope, hosting, budget, risk, and signed agreement. We state what is included and who owns each responsibility.
We favor least-privilege access, individual accounts, secure secret handling, and documented ownership of client credentials.
Projects consider secure defaults, input validation, dependency maintenance, encrypted transport, and controlled deployments according to scope.
Backup frequency, retention, restoration responsibilities, and recovery expectations must be agreed for managed systems; a backup is not assumed until configured and tested.
When a credible issue is identified, we prioritize containment, impact assessment, communication, remediation, and lessons appropriate to the engagement.
Cloud, email, DNS, frameworks, and other providers have independent risks and terms. We document relevant dependencies without claiming control over their availability.
Report suspected vulnerabilities privately to hello@wumezay.com. Provide enough detail to investigate and allow reasonable time before any public disclosure.
Security operating model
Reduce foreseeable risk through responsible technical decisions.
Define access, dependencies, and responsibilities before operation.
Contain, assess, remediate, and communicate when an incident occurs.
Responsible boundaries
Security reduces risk; it does not eliminate every attack, third-party failure, or event outside the agreed scope. Each responsibility should be defined in writing.
Private disclosure
Send a concise description, affected URL or system, reproduction steps, and potential impact. Do not access, alter, or retain data that is not yours.