Security policy

We treat security as part of the service rather than an afterthought. This page explains how to report a vulnerability, which safeguards we actually apply, and what happens if a personal data breach occurs.

Reporting a vulnerability

If you find a security issue or suspicious behaviour, email us at [email protected]. Please include enough detail for us to reproduce it: the URL, the steps you took, and the date and time. We acknowledge reports within 72 hours and keep you updated until the issue is resolved.

The same contact is published in machine-readable form at /.well-known/security.txt.

Scope

• The public website and its subdomains on noweb.lt.
• Services and endpoints we operate on that domain.

Out of scope

• Third-party services and tools we do not control.
• Social engineering or phishing against us, our partners or our clients.
• Denial-of-service (DoS/DDoS) attacks and automated load testing.
• Findings taken straight from an automated scanner report with no demonstrated impact.

Responsible disclosure

We support responsible disclosure. If you act in good faith, do not violate anyone else's privacy, do not access or copy data that is not yours, and do not disrupt our systems, we will not pursue legal action over your research. Please give us a chance to fix the issue before publishing it, or agree a timeline with us. We do not run a paid bounty programme, but we are glad to credit you publicly if you would like that.

Safeguards we apply

Currently in place:

• All traffic is encrypted over TLS, with HSTS enabled.
• A Content Security Policy with per-request nonces, plus additional browser security headers.
• Session cookies are encrypted and flagged Secure, HttpOnly and SameSite.
• Passwords are stored only as bcrypt hashes.
• Admin sign-in attempts are rate limited, and access follows the principle of least privilege.
• Forms are protected against cross-site request forgery and automated spam.
• User-submitted content is sanitised before it is rendered.
• We collect as little data as possible, and enquiries older than 24 months are deleted automatically.
• Software and its dependencies are updated regularly.

Data breach response

If a personal data breach is confirmed, we will notify the Lithuanian State Data Protection Inspectorate within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to people's rights and freedoms, we will also inform those affected without undue delay, explaining what happened and what we recommend they do.

Policy updates

We review and update this policy as our practices change. The latest version is always published on this page with the update date shown at the top.

Contact

For security questions and responsible disclosure reports: [email protected]