Security Policy

In scope

• comparedge.com and its subdomains
• Our public API and MCP endpoints under /api
• Our Atlassian Marketplace apps and browser extension

Out of scope

• Denial of service: Volumetric and stress testing. It costs us money and proves little.
• Third-party services: Vendor sites we link to, and platforms we build on. Report those to their owners.
• Missing hardening headers: Report these if you can show actual impact, not as a scanner finding on their own.
• Social engineering: Attacks against our team or our providers.

• Hosting: Vercel. The site is served from their edge network, and we hold no servers of our own.
• Edge and filtering: Cloudflare in front of everything: web application firewall, rate limits, bot filtering, and DDoS mitigation.
• Database: Supabase, a managed PostgreSQL service. Encryption at rest and backups are handled by the provider.
• Transport: HTTPS is enforced site-wide with HSTS, including subdomains, for one year.
• Secrets: Credentials live in environment variables held by the hosting platform. They are not committed to the repository.

Administrative routes sit behind authentication and additional edge rules. Access to production data is limited to the site owner.

Every response carries these headers. You can verify them yourself against any page on the site.

• Content-Security-Policy: Scripts, styles, connections, and frames are restricted to an allowlist. object-src is set to none and base-uri to self.
• Strict-Transport-Security: One year, including subdomains.
• X-Content-Type-Options: nosniff.
• X-Frame-Options: SAMEORIGIN, so our pages cannot be framed by other sites.
• Referrer-Policy: strict-origin-when-cross-origin.
• Permissions-Policy: Camera, microphone, and geolocation are switched off.

Dependencies are updated by hand as releases land, not on a fixed schedule and not through an automated alerting service. See §6.

Our Atlassian Forge app renders a table of software starting prices inside a page. What it does is deliberately narrow, and the manifest is the proof:

• No product scopes: The app requests no Atlassian permissions, so it cannot read your pages, issues, or user directory.
• No external calls: It makes no network requests. The pricing figures it displays ship inside the app itself.
• No storage: It writes nothing, neither to Atlassian storage nor anywhere else.
• No logging: It records no end-user data.

The links in the app point to comparedge.com. Following one is an ordinary click in your own browser; the app itself sends us nothing.

Our browser extension and MCP servers are documented separately, including the exact data each one handles.

Vendor security pages tend to imply more than they deliver. Ours states the gaps plainly so you can weigh them.

• No compliance certifications: We hold no SOC 2, ISO 27001, or equivalent audit. We are a small operation, and an audit of this size would be theatre.
• No paid bug bounty: We do not pay for reports today. We do read every one and credit reporters who want it.
• No penetration test on file: We have not commissioned a third-party test.
• No automated dependency alerts: Dependency scanning is not switched on for our repository. Updates are applied manually.
• No end-user accounts: The site has no customer logins and no passwords to lose. There is nothing to breach that would expose your credentials.

What we do hold is analytics and click data, described in the Privacy Policy. IP addresses are hashed before storage and server logs are kept for up to 30 days.

The date at the top reflects the most recent revision. Material changes to how we handle reports or protect data will be reflected here.