Security Policy
Effective date: January 1, 2026 · Last updated: May 21, 2026
We take the security of AgileDeck and our users' data seriously. This page describes how to report vulnerabilities and what you can expect from us.
Responsible Disclosure
If you believe you have found a security vulnerability in AgileDeck, we encourage you to notify us responsibly. We commit to working with you to verify and address the issue promptly.
Email us
Send a detailed report to support@agiledeck.org. Encrypt sensitive reports with our PGP key below.
Include reproduction steps
Provide a clear description, steps to reproduce, and potential impact. Screenshots or PoC code are helpful but never required.
Receive acknowledgement
We will acknowledge your report within 48 hours and provide a timeline for remediation.
Credit & thanks
With your permission, we will publicly credit you in our security advisories once the issue is resolved.
Scope
The following assets are within scope for vulnerability reports:
In Scope
- agiledeck.org and subdomains
- AgileDeck web application
- Authentication and session handling
- API endpoints
- Real-time SignalR hubs
Out of Scope
- Third-party services / CDN providers
- Denial-of-service attacks
- Physical security
- Social engineering
- Spam or phishing campaigns
Our Security Practices
- All data in transit is encrypted via TLS 1.2+
- Passwords are hashed with ASP.NET Core Identity (PBKDF2 + salt)
- CSRF protection on all state-changing requests via anti-forgery tokens
- Parameterised queries via Entity Framework Core — no raw SQL concatenation
- Dependency scanning and automated vulnerability alerts on every commit
- Rate limiting on authentication endpoints to prevent brute-force attacks
- Regular penetration testing by independent third parties
- Third-party API tokens (Atlassian/Bitbucket) are encrypted at rest using the ASP.NET Core Data Protection API (AES-256-CBC + HMACSHA256). Tokens are only decrypted server-side at the moment a user-initiated sync runs, and are never included in any HTTP response or client-side state.
- Two-factor authentication (TOTP) available for all user accounts
- Profile images resized and stored server-side; never accessible to other teams
PGP Public Key
For sensitive disclosures, please encrypt your email using our PGP key: