Skip to content

Security & disclosure

Security, practised on our own front door.

If a company sells cybersecurity, you should be able to check how it secures its own front door. This page sets out the security posture of missanglobal.com itself and how to report a vulnerability to us — every claim verifiable from your browser, no account required.

Report a vulnerability Back to home

What this site enforces

The controls on this domain, as deployed.

These are not policies in a drawer — they are response headers and architecture choices live on every page of missanglobal.com. Your browser received every one of them along with this very page.

HTTPS everywhere, with HSTS

Every page is served over HTTPS. Strict-Transport-Security — with includeSubDomains and preload — tells your browser to refuse plain-HTTP connections to this domain and its subdomains before a single unencrypted request is made.

Content-Security-Policy

A CSP restricts where scripts on this site may load from: our own domain, Google Analytics and our live-chat service, nothing else. A script injected from anywhere else is refused by your browser — enforced by the header, not by goodwill.

Hardened response headers

X-Content-Type-Options: nosniff stops content-type guessing, X-Frame-Options: SAMEORIGIN blocks clickjacking frames, Referrer-Policy: strict-origin-when-cross-origin limits what other sites learn about your visit, and a Permissions-Policy switches camera, microphone and geolocation off outright.

Static architecture, minimal attack surface

This site is pre-built static pages — no server-side sessions, no login system, no credentials stored on it. What a site never holds, an attacker can never take from it. Contact-form details go only to the Missan team.

A published security.txt — RFC 9116

A machine-readable disclosure file lives at /.well-known/security.txt, following the RFC 9116 standard — so security researchers know exactly where to report an issue without hunting for a contact.

Scope: this page describes the security of this website and our public disclosure process only. It is not a description of Missan’s internal corporate IT or of any client environment — those are assessed and secured per engagement.

Responsible disclosure

Found a vulnerability? Tell us.

Security researchers make the web safer, and we would rather hear about an issue from you than from an incident. Here is the route — and the ground rules.

  1. Email info@missanglobal.com

    If you believe you have found a vulnerability in missanglobal.com or a Missan-operated service, include the affected URL, what you found and — if you can — steps to reproduce it. This is the same address published in our security.txt.

  2. We acknowledge within one business day

    The one-business-day response we publish for every enquiry applies to security reports too.

  3. Good faith is respected

    While testing, do not access data that is not yours and do not disrupt the service. We will not pursue researchers acting in good faith within these rules.

Verify it yourself

Do not take this page’s word for any of it. Run www.missanglobal.com through securityheaders.com, open /.well-known/security.txt in your browser, or check the headers from any terminal: curl -sI https://www.missanglobal.com/