Security

1Password for everything.

Every credential lives in a 1Password vault scoped to one client. No shared passwords, no spreadsheets of keys, no secrets in chat. Hardware key and biometrics wherever an account allows it.

Private repos, protected main.

Client code lives in private repositories. Changes reach main only through a reviewed pull request with passing checks and signed commits. No direct pushes, no exceptions.

Reviewed before it ships.

Every deploy runs tests, type checks, lint, and a security scan first. Each one gets a ticket and a tagged release.

Encrypted in transit and at rest.

TLS on every endpoint. Encrypted storage on every service we run. Backups are encrypted with a key we hold, stored away from the primary provider.

Least privilege.

Production access is read-only by default. Write access is per project, named, and removed when the project ends. We do not hold root to your systems unless your scope asks for it.

Everything is logged.

Every change to a client system records who, when, and what. Logs are kept at least 90 days, longer if your scope says so. We can produce an audit trail on request.

1.

Tell us.

Email security@spirecoast.com with what you found, how to reproduce it, and the URL. PGP key on request.

2.

A real person replies.

Within one business day, with a rough timeline. Not an autoresponder.

3.

We fix it or explain.

Critical issues are fixed within seven days. Others get a written timeline and a fix. If we think it is not exploitable, we say why.

4.

Credit, if you want it.

Reporters who want public credit are listed on this page after the fix ships. Anonymous stays anonymous.