Security
Secure by design, not by accident.
Security is a foundation for every HFT branch. Here is how we protect this website and its visitors, and how to tell us if you find a problem.
This website
Controls protecting this site
Encrypted everywhere
HTTPS only, with HSTS so browsers never fall back to an unencrypted connection.
Strict Content Security Policy
The browser may only run scripts from this site (and Cloudflare's bot check on the contact page). No inline scripts, no third-party code.
No trackers
No advertising pixels, analytics cookies or third-party fonts. Fonts and images are served from our own domain.
Secrets stay server-side
The AI assistant's API key lives only in our edge Worker. Your browser never sees it.
Hardened APIs
Same-origin checks, strict input validation, request size limits and per-visitor rate limits on every endpoint.
Contained AI
Aurion has no tools, no database access and no ability to act. Its replies are rendered as plain text, never as HTML.
Spend guard
Per-reply output caps, a daily AI budget and per-visitor daily limits stop abuse from running up costs. Visitors are counted only as anonymous daily codes.
Private AI infrastructure
Our own AI hardware is never exposed to the open internet. It's reached only over a private network or an authenticated tunnel.
How we build for clients
- Threat modeling first. We identify what needs protecting and from whom before writing code.
- Least privilege. People, services and AI agents get only the access they need.
- Secure defaults. Secrets management, dependency scanning, and hardened configurations from day one.
- Human approval for AI actions. Agents that can change things require review for anything consequential.
- Documentation and handover. You receive clear records of how your systems are secured.
Vulnerability disclosure
If you believe you've found a security vulnerability in an HFT website or system, we want to hear about it. Please report it through our contact form with "Cybersecurity" selected. Oursecurity.txt lists current contact details.
Please include
- The affected URL or system, and a description of the issue
- Steps to reproduce, and the potential impact
- How we can reach you for follow-up
Good-faith guidelines
- Only test against systems you're authorized to test, and avoid privacy violations, data destruction and service disruption.
- Don't access, change or keep data that isn't yours. Stop and report as soon as you confirm an issue.
- Give us reasonable time to fix the issue before sharing details publicly.
- No denial-of-service testing, social engineering or physical attacks.
We'll acknowledge reports promptly, keep you updated, and credit you if you'd like. We will not pursue legal action against researchers who act in good faith under these guidelines.