The site is served over HTTPS, and a Strict-Transport-Security header instructs browsers to use HTTPS for subsequent requests.
Security
Reporting an issue, and what is in place.
CIVITERA welcomes responsible disclosure of vulnerabilities affecting this website. This page explains how to report one, what the company commits to in return, and which controls are implemented for the site.
Version published 9 September 2026
Reporting a vulnerability
CIVITERA welcomes responsible disclosure of vulnerabilities affecting this website or its published materials. Reports are received through the contact page — select the verification and compliance category, and describe the issue there.
Please include the affected URL, a description of the issue, and the steps required to reproduce it.
What we ask of researchers
- Give CIVITERA a reasonable opportunity to remediate before any public disclosure.
- Avoid privacy violations, service degradation, and the destruction or modification of data.
- Do not run automated scanning that materially degrades availability for others.
- Do not attempt social engineering, physical intrusion, or access to systems beyond the scope of this website.
- Do not include confidential, classified, or export-controlled technical information in a report. Report the security issue only.
What CIVITERA commits to
- Acknowledge a report, normally within five business days.
- Keep the reporter informed as the issue is investigated and remediated.
- Not pursue legal action against researchers acting in good faith within this policy.
Scope
In scope: this website and its published assets.
Out of scope: third-party services CIVITERA does not control, and any matter relating to patent prosecution, which is handled through the United States Patent and Trademark Office rather than through this channel.
Controls
What is implemented for this site.
Each control below is observable in the responses this site returns, and each was verified against the served headers before being listed here.
A policy defaulting to this site’s own origin, with scripts admitted only by a per-request nonce. No inline script is permitted by a blanket allowance.
Framing is restricted, so the site cannot be embedded by an arbitrary third party.
An X-Content-Type-Options header prevents browsers from reinterpreting a response as a different content type.
A restrictive referrer policy limits what is disclosed to an external site when a visitor follows a link away from this one.
Geolocation, microphone, camera, and payment interfaces are disabled for this site.
Pages are rendered on the server. There are no client-side application components, no analytics, and no third-party scripts.
No credential, token, or environment value is included in anything delivered to the browser.
The controls above describe measures implemented for this website and observable in its responses. They are not a certification, an accreditation, or the result of an external audit. CIVITERA does not claim SOC 2, ISO/IEC 27001, FedRAMP, or FIPS status, has not published the results of any penetration test, and makes no assurance claim beyond the implemented controls described here. Details of internal security architecture, incident-response procedure, and testing methodology are not published.
Also published
Related notices.
The legal notice, the privacy page, and the terms of use complete the set.
Report
Send a vulnerability report.
Use the contact page and select the verification and compliance category. Please do not include confidential or export-controlled technical information in a report.