Security
How we secure our own work
We sell security services, so our own house has to be in order. This page describes what we do, how we handle your data, and how to report a problem to us.
How we secure this site and our products
- Every page is prerendered static HTML served from Cloudflare's network. The only server code is the contact form endpoint.
- A strict Content Security Policy with no 'unsafe-inline' scripts. The only inline script is hashed, and only Cloudflare Turnstile and Cloudflare Web Analytics are allowed as third parties.
- HSTS with a two-year max-age, X-Content-Type-Options, a strict Referrer-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and a Permissions-Policy that disables unused browser features.
- Framing by other sites is blocked (frame-ancestors 'none').
- No cookies, no ad trackers, no external fonts or CDNs. Fonts are self-hosted.
- The contact form is protected by Cloudflare Turnstile, a honeypot field, per-IP rate limiting, and server-side validation. Submitted text is never echoed back as HTML.
- Dependencies are kept minimal, locked, audited in CI, and updated through automated pull requests.
Check it yourself
You do not have to take our word for it.
curl -sI https://redcastlestudio.com/The same standards apply to the job boards we operate, adapted to what each one needs.
How we handle client data and credentials
Credentials
We never ask for passwords by email or chat. We prefer access you grant through your own accounts (invited users, scoped API tokens, SSO). Shared secrets go through a password manager and are rotated when the work ends.
Least privilege
We ask for the minimum access the task needs, use separate accounts per client, and enable multi-factor authentication wherever it exists.
Client data
We only copy data off your systems when the work requires it, keep it encrypted, and delete it when the engagement ends unless you ask us to keep it.
Offboarding
At the end of an engagement we hand back or remove our access, transfer anything we created, and confirm in writing.
Responsible disclosure
If you believe you have found a security vulnerability in this site, in civilengineerjobs.net, or in blueteamjobs.com, please tell us. We appreciate the help and will work with you to fix it.
How to report
- Email security@redcastlestudio.com with a description of the issue, the affected URL, and steps to reproduce it.
- Our machine-readable contact details are in /.well-known/security.txt (RFC 9116).
- We will acknowledge your report, keep you updated, and let you know when it is fixed.
Please
- Only test against accounts and data you own, and stop as soon as you have confirmed the issue.
- Do not access, change, or delete other people's data.
- Do not run denial-of-service tests, spam, social engineering, or physical attacks.
- Give us reasonable time to fix the issue before telling anyone else.
Our commitment
If you follow this policy in good faith, we will not pursue or support legal action against you for your research. We do not currently run a paid bug bounty.