Security

1. Scope

This page describes the security of altdevapps.com, the studio website published by Rowe Digital Holdings Pty Ltd (ACN 697 515 521) as trustee for the Rowe Digital Trust (ABN 13 313 912 737), and the engineering practices behind it.

We are a small studio and we say so plainly here: we do not hold SOC 2 or ISO 27001 certification. What we do instead is keep the attack surface small, hold as little data as we can, and use managed services from providers that are themselves audited.

2. App security

Accounts, subscriptions and customer data live in the apps, not here. How an app encrypts your data, who can reach it, how long it is kept and what happens in an incident is covered by that app's own privacy policy and security information:

• PencilDrop — privacy policy on pencildrop.altdevapps.com
• BubSync — privacy policy on bubsync.com
• My Energy Agent — privacy policy on myenergyagent.au

The practices in sections 5 to 7 below are how we build software generally, so they apply to those apps too. The specifics of an app's data handling belong to the app.

3. How this website is built

• Static pages. The site is built ahead of time into plain HTML and served by Firebase Hosting through Google's content delivery network. There is no application server, no database and no input field, which removes most of the ways a marketing site gets compromised.
• Encryption in transit. TLS 1.2 or higher on every connection, with HTTP Strict Transport Security so browsers refuse to downgrade. Plain HTTP requests are redirected.
• Response headers. Responses carry a Content-Security-Policy that loads code only from this domain and from the Google hosts that analytics and advertising need, blocks framing and restricts form submissions to this origin. It also allows inline script and style, which the page needs for the theme switch and the critical CSS and which Google's advertising requires; with no user input anywhere on the site, there is nothing for an injected script to arrive through. Alongside it are HTTP Strict Transport Security, X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy.
• Two third parties, named. Google Analytics and Google AdSense are the only code the page loads from anyone else's domain, and both are listed in our website privacy policy. No tag manager, no embedded widgets. Typefaces are self-hosted.

4. No payments here

No payment is taken on this website. There is no checkout, no card field and no payment provider connected to these pages, so there is nothing here for a card skimmer to attach to. Subscriptions are bought inside a product or through an app store, and that product's policies cover how the payment is handled.

5. Access control

• Access to hosting and DNS is limited to people who need it for their role, and is reviewed when a role changes.
• Multi-factor authentication is required on every administrative account.
• Deployments use short-lived credentials issued through federated identity rather than long-lived access keys, so there is no cloud key sitting in the repository to leak.
• Administrative actions are logged, and logs are retained for review.
• Secrets are held in a managed secrets service, never in source code or configuration files.

6. Secure development

• All changes go through version control and are reviewed before they reach production.
• Automated checks run on every change, and dependency vulnerability alerts are triaged as they arrive.
• Deployments are automated from source control, so what is running is always traceable to a specific commit.
• The hosting configuration, headers included, lives in the repository and is applied through the same pipeline, rather than clicked together in a console.
• Production data is not copied into development environments.

7. Vendors

We keep the vendor list short and prefer providers with independent security certification. Before a vendor touches personal information we check what it will hold, where it will hold it, and what its own certifications and breach obligations are. The providers behind this website are listed in our website privacy policy.

8. Incident response

We maintain a written incident response plan covering detection, containment, eradication, recovery and review.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Our notification will say what happened, what information was involved, what we have done, and what you should do.

We would rather tell you early and be wrong about the scope than go quiet while we work it out.

9. Responsible disclosure

If you find a vulnerability in this website or in our infrastructure, please tell us before telling anyone else. Email hello@altdevapps.com with "security" in the subject line and include:

1. where the issue is, and what an attacker could do with it;
2. the steps to reproduce it; and
3. how you would like to be credited, if at all.

We will acknowledge within 2 business days, keep you updated while we work on it, and let you know when it is fixed.

For a vulnerability in an app, use the security contact in that app's own policies. It reaches the same engineers and gets to the right codebase faster.

While researching, please:

• use only accounts you own, or test accounts you have created;
• do not access, modify or delete another person's data, and stop as soon as you realise you could;
• do not run denial-of-service tests, automated scanners at volume, or social engineering against our staff or customers; and
• give us reasonable time to fix the issue before publishing anything about it.

We do not run a paid bug bounty. We will not pursue legal action against researchers who follow the above in good faith, and we are happy to credit you publicly if you would like that.

10. What we ask of you

Nothing on this website needs protecting on your side, because there is nothing here to sign in to. Two things are still worth knowing:

• Check who is asking. We will never email you asking for a password, a card number or a one-time code. If a message claiming to be from us asks for any of those, forward it to hello@altdevapps.com instead of replying to it.
• Secure the app account, not the website. Use a unique password, turn on multi-factor authentication where the app offers it, and review who you have shared access with. Each app explains its own controls.