How to report a vulnerability, and how we handle security on the work we ship.
We run a cybersecurity practice, so it would be strange not to hold our own work to the same standard. This page covers how to reach us about a security issue and what we do about it.
Reporting a vulnerability
Email contact@needbridgellc.com with enough detail to reproduce the issue. We acknowledge reports within two business days and will tell you honestly whether we consider it valid, including our reasoning if we do not.
contact@needbridgellc.comWhat we ask
Please do not run automated scans against production, access data that is not yours, or degrade service for others while testing. Give us reasonable time to fix an issue before disclosing it publicly.
What we ship
Every project includes a penetration test before launch: parameterised queries throughout, rate-limited authentication, server-side access control on every request, a content security policy without unsafe-inline, and no credentials in the repository.
Our own site
This site enforces HTTPS with HSTS, serves a content security policy carrying exactly two script hashes so injected script cannot execute, and makes no third-party requests other than fonts.
Tell us what you need.
One paragraph is enough. You'll get a straight answer on whether it's a fit, roughly what it takes, and what happens next.