1. RFC 9116 Security Policy & Endpoints
Astrake India maintains a machine-readable security disclosure endpoint adhering strictly to RFC 9116 at /.well-known/security.txt. We welcome responsible disclosures from security researchers, academic institutions, and infrastructure auditors.
2. Transport Layer Hardening & Active Controls
Our public web platform implements defense-in-depth security controls aligned with OWASP ASVS v4.0 Level 2 benchmarks:
- Strict Content Security Policy (CSP): Dynamic 128-bit cryptographic nonces, zero un-hashed inline scripts, zero
evalexecution, and restricted form actions. - HTTP Strict Transport Security (HSTS): Enforced with 2-year duration (
max-age=63072000),includeSubDomains, andpreload. - Subresource Integrity (SRI): All vendored primitives (Three.js, GSAP) are locked with SHA-384 cryptographic digests in
skills-lock.json. - Zero-Trust Permissions Policy: All 25 W3C sensor and hardware APIs (camera, microphone, geolocation, bluetooth, USB) are explicitly disabled.
3. Response Targets & Triage SLAs
When a vulnerability report is submitted through our authorized channels, Astrake India commits to the following operational targets:
| Triage Phase | Service Level Target | Operational Objective |
|---|---|---|
| Acknowledgment | Within 24 Hours | Initial receipt verification and ticket generation. |
| Severity Triage | Within 48 Hours | Reproduction, CVSS scoring, and root-cause isolation. |
| Critical Remediation | Within 72 Hours | Deployment of verified patch for high/critical findings. |
4. Authorized Reporting Channels
To ensure secure transmission of vulnerability details:
- Primary Channel: Submit findings through our first-party Secure Vulnerability Disclosure Form.
- Statutory & Fallback Channel: Email reports directly to office@astrake.com with subject prefix
[SECURITY DISCLOSURE].
5. Safe Harbor Covenants
Astrake India considers security research conducted in good faith under this policy to be authorized. We will not pursue legal action under computer crime statutes against researchers who:
- Avoid causing denial-of-service, disruption, or destruction of production data.
- Refrain from accessing, downloading, or exfiltrating data beyond the minimum proof-of-concept.
- Provide reasonable time for remediation before any coordinated public disclosure.