Security

Our security practices

Cast Fleet is built with security as a baseline, not an afterthought. Our current practices include:

HTTPS / HSTS enforced — all traffic is encrypted in transit; HTTP requests are permanently redirected to HTTPS with HSTS headers.
Content Security Policy (CSP) — strict CSP headers restrict which scripts, styles, and resources can load on Cast Fleet pages.
X-Frame-Options — pages cannot be embedded in iframes on third-party domains, preventing clickjacking attacks.
No third-party scripts without consent — analytics and tracking scripts are only loaded after you grant cookie consent.
Dependency scanning — we run npm audit regularly and address high and critical severity vulnerabilities promptly.
Bot protection — all public forms are protected by Cloudflare Turnstile to prevent automated abuse.

Data handling

In mock / free-tool mode, Cast Fleet processes all calculations client-side — no user inputs are transmitted to or stored on our servers. For authenticated accounts in production, user data is encrypted at rest using AES-256 and encrypted in transit via TLS 1.2+. We do not sell user data to third parties.

Responsible disclosure

If you discover a security vulnerability in Cast Fleet or any Cosyslabs product, we ask that you report it to us responsibly before public disclosure. This gives us time to investigate and remediate the issue without exposing our users to unnecessary risk.

Please email security@cosyslabs.com with the following information:

A clear description of the vulnerability and its potential impact
Steps to reproduce (including URLs, payloads, or screenshots where applicable)
Any proof-of-concept code if relevant

We aim to respond to all valid security reports within 48 hours and to provide a remediation timeline within 7 days of confirmed reports.

Security.txt

Our machine-readable security policy is available at /.well-known/security.txt in accordance with RFC 9116.

Bug bounty

We do not currently operate a paid bug bounty program. However, we credit responsible researchers who responsibly disclose valid vulnerabilities in our public changelog and — where the reporter agrees — in our Hall of Thanks. We are committed to never pursuing legal action against good-faith security researchers who follow responsible disclosure practices.

PGP

We do not currently publish a PGP public key. Please email security@cosyslabs.com directly. If you need encrypted communication, mention this in your initial email and we will arrange it.