1. Security-by-Design and Attack Surface Minimization
SipDolce Labs implements the DCP Flow technical standard, radically reducing the potential attack surface:
- Static architecture without public SQL exposure: 100% of public web pages are compiled into static HTML/CSS/JS via Astro 7. No public MySQL, PostgreSQL, or dynamic CMS server is exposed to the open web for routine browsing.
- Isolated companion PHP runtime: Web forms process through an independent companion endpoint with restricted file permissions.
- Storage located outside the web document root: The relational SQLite database operates in WAL mode outside the public docroot, inaccessible via direct HTTP URL requests.
2. Implemented Technical Safeguards
To protect our outreach infrastructure against automated abuse and payload injection, the following safeguards are active:
2.1. Zero-friction double-factor bot defenses
- Invisible honeypot field (`_sd_hp`): Hidden from human view; if populated by an automated bot or scraper, the request is immediately aborted with HTTP 400 (Spam Detected) without processing.
- Human submission latency check (`_sd_ts`): Verification ensuring requests are not submitted in sub-second intervals impossible for human typing.
2.2. Idempotency and collision control
Submissions leverage UUIDv7 identifiers paired with canonical SHA-256 payload hashing, allowing graceful replays under flaky network conditions while returning HTTP 409 (Conflict) on mismatched replays.
2.3. Restrictive HTTP security headers
- `X-Content-Type-Options: nosniff` preventing MIME-confusion sniffing.
- `X-Frame-Options: DENY` preventing unauthorized iframe framing and clickjacking.
- `Referrer-Policy: strict-origin-when-cross-origin` shielding internal navigation context.
- Mandatory TLS/HTTPS encryption in transit across all endpoints.
2.4. Input sanitization and bounded payloads
Strict character caps on all fields (e.g., maximum 4,000 characters for technical messages), strict email regex validation, and a rigid 64 KB total request body cap.
3. Realistic Security Boundaries
In alignment with honest software engineering practices, SipDolce Labs does not claim absolute invulnerability against sophisticated zero-day attacks, distributed denial-of-service (DDoS) campaigns, or upstream telecommunications transit failures.
Our commitment is rooted in defense in depth, maintainable auditable code, and prompt remediation of verified vulnerabilities.
4. Responsible Vulnerability Disclosure Guidelines
We welcome ethical contributions from the information security community to safeguard our research platform.
4.1. Ethical researcher expectations
- Report discovered vulnerabilities privately without public disclosure before a coordinated mitigation window has passed.
- Do NOT access, modify, exfiltrate, or destroy user data or system integrity.
- Do NOT execute denial-of-service attacks or disrupt platform availability for other users.
4.2. SipDolce Labs commitment
- Acknowledge receipt of valid vulnerability reports within three (3) business days.
- Diligently investigate reported vectors and deploy fixes in scheduled maintenance cycles.
- Refrain from pursuing legal action against researchers acting in good faith under these disclosure terms.