Security

Reporting a vulnerability

If you believe you have found a security problem in this site or in software we have built, email hello@cnex.ai with enough detail to reproduce it. We will acknowledge the report and tell you what we intend to do about it.

Please give us a reasonable opportunity to fix an issue before disclosing it publicly. We will not pursue legal action against anyone who reports a genuine vulnerability in good faith and does not access, modify, or destroy data belonging to others.

How this site is built

• Pages are server-rendered and almost entirely static; there is very little runtime surface to attack.
• Form submissions are validated on the server against an explicit schema. Client-side validation is a convenience, never a control.
• Public forms are rate limited per network address.
• Where sessions exist, they are server-side records that can be revoked, not stateless tokens that remain valid until they expire.
• Session tokens are stored as hashes, so a database backup does not contain usable credentials.
• Authorisation is enforced on the server for every protected route. The robots.txt disallow list is a courtesy to crawlers, never a control.

Data handling

We collect the minimum needed to reply to you. What that means in practice is described on the privacy page, field by field.

Sensitive administrative actions write append-only audit records, so what happened can be reconstructed rather than reconstructed from memory.

What we do not claim

We hold no security certifications and we do not claim any. If a certification is a requirement for your project, tell us during scoping and we will tell you honestly whether we can meet it.