Practices
How the work is built, and how it is defended.
Stated specifically rather than generally, because a specific claim is one you can test. Several of the claims below can be tested from outside without asking us anything.
How the work is done
The discipline is ordinary. What is unusual is only that it is written down and that nothing is exempt from it, including work that is late.
- Generation is a draft stage, never the last one
- AI assistance is used throughout the work. A named engineer is accountable for every line that reaches production, and review capacity is planned alongside output rather than behind it. A team that increases throughput without increasing review has not become faster; it has become less certain.
- Review is for the properties no file owns
- Syntax is the part that is now reliably fine. Review is spent on the invariants that span files, on whether the change is coherent with the system it lands in, and on whether the requirement was right in the first place.
- Small changes, visible weekly
- Work ships in increments a client can see and question while there is still time to change direction. A long silence followed by a large delivery is a way of avoiding feedback, not a way of managing risk.
- The build gate is not optional
- Every pull request, and every push to the main branch, runs a clean dependency install, a full type check, and a production build. A red build blocks the change; there is no path that skips it because something is urgent.
- Few dependencies, deliberately
- This site runs on seven runtime dependencies. Every addition is a permanent supply-chain commitment and an ongoing review burden, so the default answer to a new package is no.
- Nothing loads from a third party
- Typefaces, imagery and scripts are served from our own origin, and the content security policy enforces that rather than trusting it. The policy names two exceptions, both optional contact-form features and neither currently enabled: a Cloudflare bot check and a mail relay. Everything else is refused by the browser rather than by our good intentions.
Defence in depth
No single control is the thing standing between an attacker and the data. Each of the following is doing work on its own, and each is expected to hold when the one outside it does not.
What is running now
These describe this site and the client portal as deployed, not an intention. Where a control is visible from outside, we would rather you checked it than believed us.
Credentials
- Passwords are hashed with scrypt using a per-user random salt, and verified with a constant-time comparison so a response cannot be timed to leak a partial match.
- A copy of the database yields no password. It yields hashes with distinct salts, which is the point of the salt.
Sessions
- Session tokens are 32 bytes from the system random source and are stored only as SHA-256 digests. The server cannot produce a valid token for an existing session, and neither can anyone who reads the table.
- Cookies are HttpOnly, Secure and SameSite=Lax. A password change or reset ends every existing session for that account, because revocation that leaves live sessions behind is not revocation.
Access
- Every capability is a named permission held by a named role. There is no implicit access, and the single wildcard role is seeded onto one administrator and cannot be granted through the API.
- State-changing actions are recorded with the actor, the action and the time, whether or not anyone is watching.
Abuse and injection
- Sign-in is locked after eight failures matching either the account or the address within a rolling fifteen-minute window. The public form is rate limited per address and carries a honeypot.
- Database access is through parameterised queries by construction rather than by convention, so a string cannot become part of a statement.
- Author-supplied markdown has raw HTML escaped and link schemes restricted to http, https, mailto and same-site paths.
Transport and headers
- HTTPS with HSTS for one year including subdomains. Framing denied outright by both X-Frame-Options and frame-ancestors, MIME sniffing off, referrers trimmed cross-origin, and camera, microphone and location denied at the policy layer.
- The content security policy permits exactly two third-party origins, both named in it and both belonging to optional contact-form features that are not presently switched on. As deployed today, no page on this site makes a third-party request at all.
Data
- Visitors are not tracked. No cookies are set for a signed-out visitor, no analytics run, and nothing is loaded that could set one on our behalf. There is no consent banner because there is nothing to consent to. The portal sets one cookie, and only once you have signed in to it.
- Correspondence is written to the database before any delivery is attempted, so an outage at a mail provider cannot lose something a person wrote to us.
Check it yourself
The transport and header claims above are observable. Run this domain through any header or TLS analyser, or read the response headers directly:
curl -sI https://sigmaclava.com | grep -i \
'strict-transport\|content-security\|x-frame\|x-content-type\|referrer\|permissions'You can also confirm the absence claims. Open the network panel on any page here and count the third-party requests, then check the cookie jar. Both should be empty.
Reporting something
If you have found a vulnerability in this site, the portal, or anything we have delivered, we want to hear about it before anyone else does.
Write through the correspondence form with enough detail to reproduce the issue. Reports are read with priority and acknowledged. We will not threaten you, we will not ask you to sign anything before we look, and we will tell you what we did about it.
Please do not test in ways that degrade the service for other people, access data that is not yours, or run automated scanning that we would have to treat as an attack.
If you are evaluating us
Tell us what you need to see and we will answer it directly, in writing, before there is any proposal on the table.
If something here is not detailed enough for your process, say so and we will go deeper on that specific point rather than sending a brochure. If we cannot meet a requirement, we will tell you that in the same sentence you asked the question in.