Security

Security posture

CFW is a small advisory and systems practice. The public website is a low-risk marketing and intake surface hosted on Vercel, with domain and DNS managed through Cloudflare. The standalone public workflow audit app is operated separately at public-audit.vercel.app.

The security posture is based on data minimization, limited collection, reputable infrastructure providers, HTTPS, conservative access controls, and avoiding sensitive information in first-contact workflows.

Current safeguards

• HTTPS is active for cromwellfutureworks.com.
• Cloudflare manages domain registration and DNS.
• Vercel builds and hosts the Next.js website from the GitHub repository.
• The request-audit flow validates submissions server-side, uses a hidden honeypot path for spam handling, supports Cloudflare Turnstile server-side verification when configured, and stores leads through server-only Supabase credentials.
• Lead records are designed for Supabase row-level security with no public browser writes and no service-role key exposure to client-side code.
• Internal notifications are designed to use a verified transactional email provider such as Resend when configured.
• The public audit UI is hosted on Vercel and routes browser requests through a Render-hosted FastAPI service before database access.
• Google Workspace handles company email with MX, DKIM, SPF, and starter DMARC records configured.
• The website warns visitors not to include sensitive or regulated information in first-contact messages.

Public audit product safeguards

• Browser clients do not receive Supabase service-role credentials and do not write directly to workflow_audit database tables.
• The public API is designed to return sanitized response objects and avoid exposing raw AuditCase records, prompts, internal diagnostics, proprietary scoring logic, or Supabase row identifiers.
• Public report links are temporary, and stored inputs, stored outputs, CFW internal review copies, follow-up, and anonymized analytics depend on explicit consent choices.
• The public intake avoids file uploads and asks users not to submit sensitive, regulated, credential, trade-secret, or highly confidential details.
• The current free-tier deployment may have cold-start latency; that is a reliability limitation, not a data access exception.

Operational readiness

Some provider-level controls still depend on account setup and environment variables, including final Turnstile keys, transactional sender verification, and mailbox alias confirmation. CFW should not treat the intake workflow as fully operational until those provider checks and a live submission test are complete.

The first-contact flow intentionally avoids file uploads and should continue to avoid sensitive client data until a more specific collection, storage, access, and retention process exists.

Data handling boundaries

CFW's initial request flow should collect only enough information to understand the business context, workflow problem, tools involved, and contact path. It should not collect regulated records, credentials, customer lists, financial account details, health data, HR records, or legal matter details.

Responsible reporting

If you believe you found a security issue involving CFW's public website or systems, contact security@cromwellfutureworks.com with a concise description, affected URL or system, steps to reproduce, and any relevant screenshots or logs.

Please do not access, modify, delete, disrupt, exfiltrate, or publicly disclose data. CFW does not currently operate a paid bug bounty program.

Vendor security

CFW relies on established providers for core infrastructure, including Vercel, Render, Cloudflare, Google Workspace, Supabase, OpenAI, and planned providers such as Resend. Vendor choices may change as the business and audit product mature.

No guarantee

No security program can eliminate all risk. CFW will continue improving safeguards as the website moves from marketing presence to operational lead capture and workflow audit delivery.