Security is treated as part of the system design. Syntax uses managed infrastructure and server-side validation to protect the public application and the organism's persistent state.
Current controls
- HTTPS for the public site;
- server-side validation of organism state changes;
- global contribution limits enforced by the backend;
- private source-code repository and protected deployment credentials;
- infrastructure-level security and traffic protections provided by hosting providers; and
- monitoring and logging for operational and security troubleshooting.
Responsible disclosure
If you discover a security issue, please report it privately with enough detail for us to reproduce and assess it. Do not access, alter, or delete data belonging to other users; do not disrupt the service; and do not publicly disclose an exploitable vulnerability before we have had a reasonable opportunity to investigate.
What to include
- a description of the issue;
- steps to reproduce it;
- affected URL or feature;
- security impact; and
- supporting screenshots or minimal proof of concept where safe.
Contact
A dedicated security reporting email will be published here before public commercial launch. Until then, do not send credentials, private keys, deploy keys, or other secrets through public channels.