Loading…
Security at Busic Digital
We harden, monitor, and defend the websites we build and the AWS and Cloudflare environments that run them, so client data stays where it belongs.
$ curl -sI https://busicdigital.com
HTTP/2 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'self'; script-src 'self' 'nonce-…' 'strict-dynamic' …; object-src 'none'; frame-ancestors 'none'
x-frame-options: DENY
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
permissions-policy: camera=(), microphone=(), geolocation=()Accountable lead
One named person owns security for every site and environment we run.
Defense in depth
Hardened headers, a strict content security policy, and abuse controls on every form.
Coordinated disclosure
A published security contact and a clear process for reporting issues.
Accountable for
What we protect
Everything we build or run for a client falls into one of these. Each gets the same baseline before it goes live.
The sites and applications we design, build, and host.
The AWS and Cloudflare environments that run client sites.
Form submissions, lead records, and the integrations that move them.
How we work
The same loop runs on every build, before launch and for as long as we host it.
Security headers, a strict content security policy, and locked-down configuration before anything goes live.
Vulnerability triage and validation, dependency audits, secret scanning, and authorized testing of client sites.
Detection and alerting on the systems we run, so problems surface early.
Contain the issue, rotate exposed credentials, fix the root cause, and document what happened.
Controls on this site
Every line below is live in production. Check it yourself with curl -sI https://busicdigital.com.
max-age, includeSubDomains, and the preload directive.'strict-dynamic', plus object-src 'none', base-uri 'self', and form-action 'self'.frame-ancestors 'none' and X-Frame-Options: DENY.X-Content-Type-Options: nosniff.Referrer-Policy: strict-origin-when-cross-origin.Permissions-Policy turns off camera, microphone, and geolocation.Report a vulnerability
Send reports to logan@busicdigital.com. We read every one.
Email the affected URL or system, what you found, and the steps to reproduce it. Screenshots or a proof of concept help.
You get a reply confirming we received the report and are looking into it.
We confirm the issue, fix it, and keep you updated while the work is in progress.
If you want to publish your findings, we agree on timing with you once the fix is live.
Email the security lead directly. Include as much detail as you can, and we will take it from there.