Security

How we work

• Mutual TLS between services, and TLS for every public endpoint.
• Short-lived credentials issued by Vault; private keys stay in memory where possible.
• Least-privilege permissions, checked on every request, and a second factor for destructive operations.
• Dependencies pinned and updated automatically, and changes reviewed before they reach production.
• Centralised logs and alerts, with an on-call rotation.

Reporting a vulnerability

Write to security@globalso.dev. Include what you found, where, how to reproduce it, and what impact you think it has. Our security.txt is at /.well-known/security.txt.

We'll acknowledge your report within three business days, keep you informed while we fix it, and credit you when it's resolved if you'd like.

Scope

In scope: globalso.dev, no-id.org and their subdomains, and the code in our public repositories.

Out of scope: denial of service, social engineering of our team or clients, physical attacks, and findings in third-party services we use.

Safe harbour

If you act in good faith, follow this policy, avoid accessing or changing other people's data, and give us reasonable time to fix the issue before disclosing it, we won't take legal action against you for your research.