Security Architecture & Responsible Disclosure
Last Updated: August 30, 2026 · Security Officer: security@dosvectis.com
1. Security Architecture & Core Posture
DosVectis applies a defense-in-depth, zero-trust security architecture across all client deliveries and internal infrastructure. We enforce security-as-code and automated vulnerability gating at every commit.
- Zero Standing Privileges: JIT administrative access with multi-factor authentication (FIDO2/WebAuthn hardware keys required).
- Encryption Standards: All data at rest is encrypted with AES-256 (KMS envelope encryption). Data in transit requires TLS 1.3 with strict HSTS and PFS cipher suites.
- Continuous Scanning: Automated AST (Static Application Security Testing), container vulnerability scanning (Trivy), and secret leak detection (GitGuardian) enforced in CI/CD lanes.
2. Responsible Vulnerability Disclosure
We welcome reports from security researchers and practitioners. If you believe you have discovered a vulnerability in our public web properties or open repositories, please report it responsibly according to the following principles:
- Give us a reasonable timeframe (minimum 30 days) to mitigate and verify the issue before public disclosure.
- Do not execute denial of service (DoS/DDoS) attacks or automated brute-force scanning that disrupts active services.
- Do not access, modify, or destroy customer or third-party data.
3. Bug Bounty & Safe Harbor Guidelines
Researchers operating in good faith who comply with our disclosure policy will be granted safe harbor. We will not pursue legal action against security testing performed in accordance with these guidelines.
Security Contact & Incident Desk
Send vulnerability reports or compliance verification requests to security@dosvectis.com. SLA response within 12 hours for critical severity reports.