security · :443
Security
Port 443 is in our name because encryption is where we start. Here’s how we handle security in client work, and how to tell us if we got something wrong.
How we work
- TLS everywhere, including internal services and staging environments.
- Least-privilege access to client environments, granted per squad and removed when an engagement ends.
- Secrets live in managed vaults and never in repositories.
- AI-generated code goes through the same human review as everything else, and we only use AI tools under terms that exclude training on client code.
- Dependency and vulnerability scanning runs in CI on every project.
Report a vulnerability
If you’ve found a security issue on rogue443.com, email security@rogue443.com with enough detail for us to reproduce it. We’ll acknowledge your report within 15 business days and keep you posted until it’s fixed.
We won’t pursue legal action over good-faith research that respects people’s privacy, avoids disrupting the service and stays within scope. Issues in systems we’ve built for clients belong to those clients, so please report them to the client directly.
security.txt
Contact: mailto:security@rogue443.com Expires: 2027-06-01T23:59:59Z Preferred-Languages: en Canonical: https://rogue443.com/.well-known/security.txt Policy: https://rogue443.com/security