Report a vulnerability

What this policy covers

This page explains how to report a security flaw affecting menlo-capital.com and the services Menlo Capital exposes publicly. It is referenced by the Policy field of /.well-known/security.txt, per RFC 9116.

Menlo Capital is a small holding company: there is no on-call security team. The commitment is about response and remediation, not an hourly service level.

How to report

Use the contact form on this site and put "security" in the subject. It reaches the same inbox as everything else, and it is handled first.

Describe the vulnerability, the URL or component affected, and the steps to reproduce it. A screenshot or a single request is usually enough.

Email us

What we commit to

Acknowledgement within 3 business days. An assessment of validity and severity within 10 business days. A fix on a timeline proportionate to severity, and a note back to the reporter when the report is closed.

We will not pursue anyone who follows this policy, acts in good faith, and degrades neither the service nor any data.

Scope and limits

In scope: menlo-capital.com and menlo-capital.fr, which serve the same site, together with their subdomains, including security headers, TLS configuration and the site dependencies.

Out of scope: denial-of-service testing, social engineering aimed at individuals, form spam, and automated scanner output with no demonstrated impact. The group sites (purcept.fr, mindlapse.ai) have their own contacts.

The site is static, with no user accounts, no database and no cookies. The attack surface is therefore limited to service configuration and headers.

Measures in place

A strict Content Security Policy, built from SHA-256 hashes at each build, with default-src set to 'none'. One-year HSTS, plus nosniff, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP and CORP.

A verified publishing chain: secret scanning on every contribution, dependency auditing, and a failing build never deploys.