Security boundaries

Security Practices

Citadel Tech Labs treats public submissions as untrusted. The public request form is designed for describing a problem, not for sending credentials or authorizing access to client systems.

Do not send secrets through the public form

Do not submit passwords, API keys, private keys, access tokens, recovery codes, payment details, regulated records, or confidential datasets. If access is required after scope approval, we will identify an approved secure channel.

Authorization required

Security reviews, scans, recovery work, platform changes, and administrative access require verified authority and a defined scope before work begins.

Operational safeguards

• HTTPS for public site traffic.
• Same-origin intake API behind nginx.
• Request size limits, rate limits, and honeypot abuse checks.
• Idempotency handling to reduce duplicate submissions.
• Separate intake records and CRM outbox records for controlled handoff.

Vulnerability reports

If you believe you found a vulnerability in this website, use the request form and describe the issue without exploiting it, accessing data, degrading service, or testing systems outside this domain.