Security
Last updated:
Found a vulnerability? Email security@vigiloweb.com. We respond within 5 working days and don’t take legal action against good-faith research.
Scope
- In scope: vigiloweb.com and its subdomains.
- Out of scope:
/lab/*(intentionally insecure test pages), volumetric or denial-of-service attacks, social engineering.
Good faith
Please give us reasonable time to fix an issue before you publish it, don’t access or change data that isn’t yours, and stop as soon as you have shown the problem.
How this site is set up
- Strict Content-Security-Policy (
default-src 'self'), no inline scripts, nothing loaded from third parties (except agency logos on white-label reports). - HSTS,
X-Content-Type-Options: nosniff,frame-ancestors 'none', a strict referrer policy and a restrictive permissions policy. - Passwordless sign-in: single-use links valid for 15 minutes. Sign-in tokens and sessions are stored only as hashes, and sign-in links are removed from the copy of each email we keep for delivery records.
- One cookie, set only when you sign in:
vg_session, HttpOnly, Secure, SameSite=Lax.
Machine-readable contact details: /.well-known/security.txt.