# Security Policy & Standards: Incisive Cyber

## 1. Our Commitment to Security

At Incisive Cyber, security is embedded into our engineering lifecycle, consulting engagements, and operational processes. We enforce high standards of technical hygiene, zero trust controls, and defensive engineering.

---

## 2. Secure Coding & Development Standards

All software, web applications, and scripts developed for Incisive Cyber must adhere to the following controls:

- **Strict Content Security Policy (CSP)**: Disallow inline unsafe scripts (`'unsafe-inline'`), force HTTPS for external resources, and enforce strict frame ancestors.
- **Input Sanitisation & Escaping**: All user input received via forms or APIs must be validated and HTML-escaped before rendering to prevent Cross-Site Scripting (XSS).
- **Subresource Integrity (SRI)**: Any external fonts or stylesheets must include cryptographic SRI hashes.
- **Pre-Flight Automated Audits**: Deployments are blocked if the automated security pre-flight script (`node scripts/security-check.js`) reports any high or critical warnings.
- **Zero Secrets in Source Control**: Secrets, API keys, and sensitive tokens are strictly managed via environment variables and never committed to repository source trees.

---

## 3. Reporting a Vulnerability

If you discover a security vulnerability in Incisive Cyber systems, web applications, or published code, we invite you to report it responsibly.

### Contact Information
- **Security Team Email**: `security@incisivecyber.com` (or submit via our secure contact form on the website).
- **Response SLA**: We acknowledge receipt of vulnerability reports within 24 hours.

### Guidance for Vulnerability Researchers
- Provide detailed steps to reproduce the issue.
- Do not access, modify, or destroy client data.
- Allow reasonable time for remediation prior to public disclosure.

---

## 4. Security Verification Workflow

Developers and maintainers must run the following check before submitting code or staging production releases:

```bash
npm run sec-check
```

This verifies header security, CSP structure, script execution policy, and dependency cleanliness.