Transport security
Production deployment should force HTTPS and use a valid TLS certificate. HTTP requests should redirect to HTTPS.
Application security
- Keep Next.js and dependencies updated.
- Validate and sanitise all server-side form submissions.
- Apply rate limiting and anti-spam controls to public forms.
- Store secrets only in server-side environment variables.
- Use restrictive security headers and a Content Security Policy appropriate to deployed integrations.
- Do not expose internal systems, credentials or confidential technical data.
Vulnerability reporting
A dedicated security-reporting address or process may be added once SayVM approves the responsible contact and handling workflow.