Security

What this page covers

Two different things share a name here. On one side this website, a public shopfront that processes no customer data. On the other the ORBIT platform, the software organisations actually use, whose guarantees - identity, encryption, auditability, hosting - are of an entirely different order.

The platform's commitments are set out in the Security section of the home page. They do not apply to this marketing site, and nothing on this page says anything about the security level of the platform.

A deliberately small exposure surface

The site is a set of static files, produced once at build time. That architecture removes whole categories of risk outright.

• No code runs server-side to produce a page: no rendering engine, no interpreter. The pages are built once and for all at build time.
• A single application endpoint exists, /api/demonstration, which receives the demonstration request form. It stores nothing: the request is relayed by email to our contact address, and that is its only record.
• No database, and therefore no injection into a data store.
• No accounts, no sessions, no authentication on this site.
• Images, fonts and nearly all scripts come from the site's own domain. Three exceptions: cookieless audience measurement, loaded from static.cloudflareinsights.com, from the first page read; the form's anti-robot check, loaded from challenges.cloudflare.com, only if you start filling in the form; Google Analytics audience measurement, loaded from www.googletagmanager.com, only if you accepted audience measurement.
• A deliberately minimal amount of code running in the browser, with no application framework.

The site is served over HTTPS only. The connection data processed in doing so is described in our privacy policy.

Build chain

A static site moves the risk to whatever builds it. The following safeguards apply to every publication.

Dependency audit

An audit runs on every integration and blocks publication at the "high" threshold.

Software inventory

A CycloneDX SBOM is produced at every build and retained.

Updates

Dependencies and integration actions are monitored weekly.

Pinned chain

Integration actions are pinned by digest, never by a moving tag.

No secrets

The repository holds no secrets; they live in the vaults of the forge and the host.

Report a vulnerability

If you believe you have found a flaw on this site, write to cybersecurite@secalys.fr. Please do not disclose it publicly before we have had a chance to fix it.

We acknowledge receipt within five working days and keep the reporter informed until the matter is resolved. We do not offer a financial reward. No legal action will be taken over research carried out in good faith, without degrading the service and without accessing data that is not yours.

In scope

• Content injection or XSS in the published pages.
• Misconfiguration of the security HTTP headers.
• Information leakage in the published files.
• A vulnerable dependency embedded in the site build.
• A flaw in the form collection endpoint, /api/demonstration: validation, rate limiting, routing.

Out of scope

• Vulnerabilities in the ORBIT platform itself, which go through a different channel.
• Automated reports with no proof of exploitability.
• A missing best practice with no demonstrated impact.