Trust center

Trust has to be demonstrated

How we develop, ship and protect the Navin platform, how this site handles your data, and how to report a vulnerability to us.

Security practices

A development and delivery chain under control

The same requirements apply to our code and to the platform we ship.

Secure development
Code analysis, secret detection and dependency auditing on every change: semgrep, gitleaks, pip-audit and Trivy block delivery when something is wrong.
Supply chain
CI tools pinned and verified by checksum, SBOMs generated by Syft, images signed with Cosign and admitted by Kyverno.
Verifiable releases
Every release publishes its packages, a SHA256SUMS file and a manifest that links each file to the commit and the build chain.
Threat model
Assets, trust boundaries, attacker profiles and a STRIDE analysis per layer, kept up to date with the platform.
Tests that prove
Every attack class is linked to a control and to the automated test that checks it.
Incident response
Incident procedures, SOC, kill switches and the chain of custody of evidence are documented and tooled.

This site

This site applies the principles we stand for.

No trackers
No advertising cookie and no third-party audience measurement. A single functional cookie remembers your language.
No external resources
Fonts, images and scripts are served by our servers. A strict content security policy blocks everything else.
Protected forms
Forms are validated on the server, protected against automated submissions and sent to our API through signed requests.
Pseudonymized IP addresses
Your IP address is not stored: only a non-reversible fingerprint is used to prevent abuse.

Responsible disclosure

If you believe you have found a vulnerability in the Navin platform or in this site, please report it to us responsibly.

01
Write to the address below with the subject "Vulnerability", or use the contact form and choose "Security report".
02
Describe the affected component, its version, the steps to reproduce and the estimated impact.
03
Do not include third-party personal data: a minimal proof is enough.

This information is also published in the security.txt file of this site. /.well-known/security.txt

Only test systems you own or are authorized to test.
Do not access data that is not yours beyond what is strictly needed to demonstrate the vulnerability, and do not keep it.
No denial of service, social engineering or physical action.
Give us a reasonable time to fix the issue before any publication.

We acknowledge your report and keep you informed of its handling.
We fix confirmed vulnerabilities according to their severity.
We do not take legal action against research carried out in good faith and within these rules.
With your agreement, we credit your contribution when the fix is published.