Only what we actually do.

Code is reviewed before it is merged. New dependencies are reviewed before they are added. We run static analysis on our own code using scanning tooling we built internally.

Secrets are kept out of repositories and injected through environment configuration.

Access to infrastructure and customer material is least-privilege: people get access to what their work requires and nothing more. Accounts are protected with hardware security keys or multi-factor authentication.

Customer data is separated per project. Work for one customer does not sit in another customer’s environment.

All traffic to alialabs.org is served over TLS. Devices and backups that hold project material are encrypted at rest.

Project material is used only for the engagement it belongs to. Access is limited to the people working on that engagement.

At the end of an engagement, project material is returned or destroyed on request. We sign NDAs before sensitive documents are exchanged. Ask for one before sending anything you would not want us to see without it.

Development, testing and production are kept separate. We touch customer production systems only when the engagement requires it, and we prefer to work under the customer’s own access controls rather than standing credentials of our own.

Dependencies are pinned. New dependencies are reviewed before they enter a project. During an active engagement, and during any contracted support period after it, we monitor published vulnerability advisories for what we ship and update when they affect us. Monitoring beyond that period is a support arrangement rather than something every project carries indefinitely.

Project work is kept in versioned, encrypted backups, so a lost device or a bad change does not lose customer work.

If you believe you have found a vulnerability in anything ALIA Labs operates, email adrian@alialabs.org. We will acknowledge within a reasonable time, investigate, and credit the report if you want credit.

Do not test against systems we operate for customers.

Reports and sensitive documents can be encrypted to our OpenPGP key. Mail clients that support Web Key Directory find it automatically from the address above. You can also download the public key directly.

Check the fingerprint above against the key you import. If they do not match, do not use the key, and tell us.