Changes through pipelines
Changes to our platform are made through version control and automated pipelines wherever possible, and we keep a register of the exceptions.
Security
Reporting a security issue
If you think you have found a vulnerability in a website or service we run, please tell us. We take every report seriously and will work with you to understand and fix it.
How to report a vulnerability
Email us with the details. Please do not disclose the issue publicly, for example on social media or in an issue tracker, until we have had a chance to fix it.
A useful report includes:
- The website, address or service affected.
- What the issue is and what someone could do with it.
- The steps to reproduce it, with any requests, proof-of-concept code or screenshots that help.
- When you found it, and whether you think anyone else knows about it.
- How we can contact you to follow up.
We will acknowledge your report, keep you informed while we investigate and fix the issue, and tell you when it has been resolved.
This applies to portervalley.tech and the services we operate. If you find an issue in a website or system we build or host for a client, you can report it to us in the same way and we will work with the client to resolve it.
Good-faith research
We welcome security research carried out in good faith. While you investigate, please follow these guidelines.
- Do not access, change or delete data that is not yours. Use only the access you need to show the issue, then stop.
- Respect privacy. If you come across personal data, stop, do not keep or share it, and tell us in your report.
- Do not run denial-of-service tests or anything else that degrades a service for other people.
- Do not use social engineering, phishing or physical attacks against us, our clients or anyone else.
- Give us reasonable time to fix the issue before you share details with anyone else.
If you follow these guidelines and report what you find promptly, we will treat your work as a good-faith contribution and work with you to resolve the issue.
How we run our platform
A summary of the practices we follow. Our Forge pages describe how the platform is built and the software it runs on; for the security of our clients, we do not publish operational details such as addresses, hostnames or configuration.
Separate machine identities
Automated jobs use dedicated machine identities rather than personal accounts.
Encrypted connections
Our websites and services are served over TLS.
UK data, built in Sheffield
Data is hosted in the UK and our platform is built in Sheffield. Public websites can also be served through a content delivery network so they load quickly.
Privacy-friendly analytics
This website sets no cookies. We count visits with analytics we host ourselves, which use no cookies and do not follow you across other sites.
Security tools can find these contact details in our security.txt file. /.well-known/security.txt