Security
Security is part of the architecture of the House. If you find a weakness, tell us quietly and we will work on it with you.
Scope
This policy covers the website at linconnu.co. The pre-opening site has no accounts, checkout, payment or forms, so the most relevant issues concern the integrity of what the site serves and how it is delivered.
- Ways to change, inject or replace content served by linconnu.co.
- Weaknesses in response headers, redirects, framing or cross-origin behaviour with a demonstrable effect.
- Exposed credentials, configuration or private material in the site or its public repository.
- Anything that could let one visitor affect another visitor’s experience or data.
Out of scope
- Third-party services the House does not operate, including the hosting provider’s own platform. Report those to the provider.
- Denial-of-service, load or volumetric testing.
- Social engineering, phishing or physical attempts against people or premises.
- Reports generated only by automated scanners, without a demonstrated impact.
- Missing best-practice headers or settings with no exploitable consequence. These are still welcome as suggestions.
How to report
There is no monitored reporting channel today, so the House cannot receive or acknowledge a security report yet. No address has been published for this purpose; please do not send reports to anyone presenting themselves as a L’INCONNU security contact. The channel will be published on this page before accounts, transactions or client services open. If you hold a finding that cannot wait, keep it private and return here.
Testing in good faith
- Use only accounts and data that belong to you. Stop as soon as you reach anyone else’s information, and do not keep, share or alter it.
- Do the minimum needed to show the issue exists.
- Do not degrade the site for other visitors.
- Give the House reasonable time to fix the issue before discussing it publicly, and agree a disclosure date together where possible.
What the House will do
Once a channel is open: read every report, confirm receipt, keep you informed where you ask to be, fix confirmed issues in proportion to their risk, and credit you if you wish once the fix is live. The House is small, so it will not promise response times it cannot keep.
Good-faith research
From the day a reporting channel is published: if you follow this policy, the House will regard your research as authorised and will not pursue or support legal action against you for it. This does not bind third parties, and it cannot authorise anything the law does not allow.
No bug bounty
L’INCONNU does not currently offer payment or rewards for reports. Thanks, and public credit if you want it, are what the House can honestly offer.
Baseline controls
HTTPS with HSTS, content-type protection, a restrictive browser permissions policy, framing and form protection, a content security policy that is partly enforced and partly still observed, automated dependency checks, and an automated quality gate on every proposed change. The House does not yet publish a conforming security.txt, because that file requires a working contact.