I take the security and privacy of visitors to nisalgunawardhana.com seriously. This page explains the security practices used to protect the website and provides a responsible way to report potential security vulnerabilities.
1. Our Security Practices
- HTTPS / TLS Encryption: All traffic to and from nisalgunawardhana.com is protected using HTTPS/TLS encryption.
- Secure Infrastructure: The website is hosted using modern cloud infrastructure with appropriate access controls and security configurations.
- Security Headers: Security headers are configured to provide additional protection against common browser-based attacks.
- Secure Development Practices: The website is developed and maintained following modern web security practices and industry guidance.
- Dependency Monitoring: Third-party libraries, packages, and dependencies are regularly reviewed for known security vulnerabilities.
- Access Control: Administrative access to the website and related infrastructure is restricted and protected using appropriate authentication controls.
- Data Protection: Personal information submitted through the website is handled with appropriate security and access controls.
- Regular Security Reviews: The website and its infrastructure are periodically reviewed for potential security issues and misconfigurations.
2. Security Standards
The website's security practices are informed by recognized industry guidance, including:
- OWASP Top 10
- OWASP Web Application Security guidance
- OWASP API Security guidance, where applicable
- TLS security best practices
- Secure software development practices
Security controls are reviewed and improved as the website and its infrastructure evolve.
3. Security Testing
Security testing is performed using a combination of automated tools and manual reviews.
Website Security
- Mozilla HTTP Observatory: HTTP security configuration testing
- Qualys SSL Labs: TLS/SSL configuration testing
- Security Headers: HTTP security header analysis
- Google Safe Browsing: Website safety and reputation monitoring
- VirusTotal: URL and domain reputation checks
Application Security
The website is reviewed for common web application vulnerabilities, including:
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- SQL Injection, where applicable
- Authentication and authorization issues
- Session security
- Insecure direct object references
- Security misconfiguration
- Sensitive information exposure
- Insecure file uploads
- API security, where applicable
Dependency Security
Third-party dependencies and libraries are regularly reviewed for known vulnerabilities. Where vulnerabilities are identified, they are evaluated and addressed through updates, configuration changes, or other appropriate mitigations.
4. Responsible Vulnerability Disclosure
If you discover a potential security vulnerability affecting nisalgunawardhana.com, please report it responsibly.
Security contact: security@nisalgunawardhana.com
Please include:
- A description of the vulnerability
- The potential security impact
- Steps required to reproduce the issue
- The affected URL, endpoint, or feature
- A proof of concept where appropriate
Please do not:
- Access, modify, download, or delete other users' data
- Perform denial-of-service attacks
- Attempt social engineering or phishing
- Send spam or malicious traffic
- Publicly disclose the vulnerability before there has been reasonable time to investigate and address the issue
I will review legitimate security reports and work to address confirmed vulnerabilities as appropriate.
6. Security Updates
Security is an ongoing process. The website, dependencies, infrastructure, and security configurations are periodically reviewed and improved as new vulnerabilities and security threats emerge.
For security-related questions or vulnerability reports: security@nisalgunawardhana.com
Nisal Gunawardhana
Software Engineer & Technology Community Builder