Security & Responsible Disclosure

We would rather hear about a weakness than not. If you believe you have found a security issue affecting NAFSoft or any system we operate, contact us through the contact page and mark your message as a security report.

If you report a vulnerability

Tell us the affected system, how to reproduce the issue, and what you observed. Do not access, modify or download data that is not yours, do not degrade or disrupt any service, and do not test against production accounts belonging to other people. We will acknowledge your report, keep you informed of our assessment, and credit you if you wish, once the issue is resolved.

How we build and run software

The practices below apply to client delivery work as part of our standard method, and are agreed explicitly in each engagement:

• Access control on a least-privilege basis, with separate and individually attributable accounts.
• Encryption of data in transit, and of stored data where the platform supports it.
• Reviewed code with automated dependency and secret scanning in the pipeline.
• Security review against the OWASP Top 10 before production release.
• Test data that is masked or synthetic; production data is not copied into development environments.
• Documentation of what was delivered, who can reach it, and how it is operated.

What we will never ask you for

We will not request your password, a full payment card number, or one-time authentication codes by email or through this website. If you receive such a request that appears to come from us, report it through the contact page.

Certifications and audits

We do not publish certification marks on this site. Where an engagement requires a security questionnaire, an audit, or evidence of controls, we complete it directly with the client under confidentiality and provide the underlying evidence on request.

Last reviewed 2026. Questions about this page: see the contact page.