MariVira — Security & Responsible Disclosure
Product: MariVira (marivira.com) · Version: 1.0.0 · Effective date: 2026-07-11 · Last updated: 2026-07-11
We take the security of your boat records seriously. This page summarises how we protect data and how to report a vulnerability.
1. How we protect your data
- Encryption in transit: all traffic uses HTTPS/TLS, with HSTS at the edge.
- Passwords: stored only as bcrypt hashes, never in readable form.
- Sessions: short-lived access tokens plus server-side refresh sessions that
rotate on every use, with reuse detection — a replayed token revokes all of your sessions. Logging out or changing your password revokes active sessions.
- Strict data isolation: every request is scoped to your account; you can never
read or modify another user's data (cross-account access returns "not found").
- Access control: role-based administration; administrative functions are
restricted to authorised staff.
- Abuse resistance: authentication endpoints are rate-limited; security headers
and a strict cross-origin allowlist are enforced.
- Uploads: files are validated by type and size; downloads are authenticated and
limited to the owner (or authorised staff).
- Auditing: important changes are recorded in an audit log with passwords and
sensitive fields redacted.
- Resilience: the service performs daily database backups with a tested restore
procedure, and validates its production configuration on startup (refusing to run with weak secrets or missing settings).
No system is perfectly secure, but we work continuously to protect your data.
2. Reporting a vulnerability
If you believe you have found a security vulnerability, please tell us before disclosing it publicly. Email legal@marivira.com (interim, until a dedicated address is confirmed: legal@marivira.com). Please include:
- a description of the issue and its potential impact;
- steps to reproduce (proof-of-concept if possible);
- the affected component (web, mobile, API) and any relevant URLs.
3. Guidelines for researchers (safe harbour)
We support good-faith security research. If you follow these guidelines, we will not pursue legal action for your testing:
- Do not access, modify or delete data that is not yours; use only test accounts you
control. Never attempt to access other users' data.
- Do not run attacks that degrade the service (e.g. denial-of-service, spam, or
large-scale automated scanning).
- Do not use social engineering, physical attacks, or target our staff or vendors.
- Give us reasonable time to remediate before any public disclosure, and keep details
confidential until we confirm a fix.
4. Our response
We will acknowledge your report, investigate, and work on a fix. We aim to respond within a reasonable timeframe and will keep you informed. If personal data is affected by an incident, we will handle notification in line with applicable law.
5. Scope
In scope: www.marivira.com, app.marivira.com, admin.marivira.com, api.marivira.com, and the MariVira mobile apps. Third-party services (hosting, email) should be reported to their respective providers.
6. Contact
Security: legal@marivira.com (interim: legal@marivira.com).
Deletion and privacy help: privacy@marivira.com