Security and vulnerability disclosure
If you think you have found a security issue in chosenmark.com or anything we run, please tell us. We will not take legal action against good-faith research that follows this page.
How to report
Email security@chosenmark.com with a description, the steps to reproduce and the impact you expect. Our machine-readable contact file is at /.well-known/security.txt.
What we commit to
- We acknowledge reports within 2 business days and keep you updated until the issue is fixed.
- We credit you when the fix ships, if you want to be credited.
Please don't
- Access, change or delete data that isn't yours, or keep any data you encounter.
- Run denial-of-service tests, spam our forms or email, or use automated scanners that send high volumes of requests.
- Social-engineer our staff or clients, or test physical security.
How we protect client data
- All traffic is HTTPS with HSTS. Client links (proposals, invoices, intake forms) use long random tokens and are never indexed.
- The admin area requires a strong password, rate-limits sign-in attempts and expires sessions after 12 hours.
- Payments by card are handled by Stripe; we never see or store card numbers.
- Personal data is handled as described in our privacy policy.