Security & Responsible Disclosure

How we protect client systems, and how to report a vulnerability in good faith.

Our security posture

Security is core to what we sell. WarMachine33 (Delta-One Capital Sàrl, Geneva) designs and operates automations under Swiss data protection law (nLPD/nDSG) and GDPR. Key practices on this website:

  • HSTS (preload), strict transport security, and a Content-Security-Policy on every response.
  • X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and a restrictive Permissions-Policy.
  • Client automations run on infrastructure the client owns, your data stays under your control, not held hostage by us.
  • Payments are processed by Stripe. We never store card data.

Responsible disclosure policy

We welcome reports from security researchers acting in good faith. If you believe you have found a vulnerability affecting warmachine33.cloud or our services, please tell us before disclosing it publicly.

How to report: email [email protected] with a clear description, steps to reproduce, and any proof-of-concept. Encrypt sensitive details on request.

Our commitment:

  • We acknowledge reports within 72 hours.
  • We will keep you updated on remediation and credit you (if you wish) once resolved.
  • We will not pursue legal action against researchers who act in good faith, respect the scope below, and avoid privacy violations, service degradation, or data destruction.

In scope: warmachine33.cloud and its subdomains that we operate.

Out of scope / please avoid: denial-of-service, spam or social-engineering of staff or clients, physical attacks, automated scanning that degrades service, and any access to or modification of data that is not your own. Do not test third-party services (e.g. Stripe, hosting providers), report the integration point to us instead.

Machine-readable contact details are published at /.well-known/security.txt (RFC 9116).

← Back to home