Security policy

Vulnerability disclosure policy

We operate a coordinated vulnerability disclosure programme. If you discover a security vulnerability in Clerkfolio, we ask that you report it to us privately before disclosing it publicly, giving us a reasonable opportunity to investigate and address the issue.

Scope

The following are in scope for security research:

• clerkfolio.co.uk and all subdomains
• The Clerkfolio web application (portfolio, case diary, sharing, exports, authentication)
• Clerkfolio application API routes that back the web app

Out of scope

The following are explicitly out of scope. Reports in these categories will not be acted upon and may void safe-harbour protections:

• Denial of service or resource exhaustion attacks of any kind (including volumetric, application-layer, or slowloris-style)
• Social engineering, phishing, or other attacks targeting Clerkfolio staff or users
• Physical attacks on infrastructure
• Issues in third-party services or infrastructure outside our reasonable control (Supabase, Vercel, Stripe, Resend, Upstash)
• Automated scanning of production systems without prior written permission
• Attacks against systems, accounts, or data belonging to other users without their consent
• Non-exploitable information disclosures with no realistic attack path (e.g. version banners, missing optional headers)
• Clickjacking on pages with no sensitive actions
• Missing DNSSEC, CAA records, or similar hardening that is not exploitable in context

Safe harbour

Clerkfolio will not initiate legal action against, or make any complaint to law enforcement about, researchers who:

• Report vulnerabilities to us privately at admin@clerkfolio.co.uk before any public disclosure.
• Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability.
• Do not disrupt or degrade the service for other users.
• Stay within the scope defined above.
• Act in good faith throughout the disclosure process.

Good-faith research that complies with these guidelines is authorised. We will work with you to understand and address the issue quickly.

Response times

Clerkfolio is operated by a single developer, so response times are aims rather than guarantees: we aim to acknowledge reports within a few business days, to triage promptly, and to prioritise fixes by severity, with critical issues addressed as fast as reasonably possible. We will co-ordinate a disclosure timeline with you and aim to allow public disclosure once a fix is deployed, or after 90 days from your report, whichever is sooner, unless we agree a different timeline.

Bug bounty and recognition

Clerkfolio does not operate a paid bug bounty programme at this time. We may offer public credit (in a security acknowledgements page, if you consent) or a small token of appreciation at our discretion for valid, in-scope reports. We appreciate the time and skill of independent security researchers.

Security measures overview

Clerkfolio implements defence-in-depth across the application stack:

• Encryption at rest (Supabase managed encryption, eu-west-2) and in transit (HTTPS/TLS 1.2+)
• Row-level security (RLS) on all Supabase database tables
• Supabase Auth with PKCE flow; session management with expiry and revocation
• CSRF origin validation on all state-changing API routes
• Rate limiting via Upstash Redis on public and sensitive endpoints
• Hashed IP addresses and hashed PINs for share-link access control
• Server-side MIME type and file-format validation for evidence uploads; antivirus scanning is not currently provided
• Content Security Policy, X-Frame-Options, HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy headers
• Soft-delete with a 30-day trash window for portfolio entries and cases; account deletion and user-initiated evidence removal are hard deletes, as described in the Privacy policy
• Session fingerprint tracking to detect and revoke suspicious sessions

More detail is available in our Privacy policy. Third-party security posture is governed by each provider's own controls and certifications - see the subprocessors page.

Contact

• Security reports: admin@clerkfolio.co.uk
• General / data protection: admin@clerkfolio.co.uk