Security
Security
How this site is protected, and how to report a problem. Only measures actually in place are listed.
Reporting a vulnerability
If you believe you have found a security problem, email contact@qentratech.com with enough detail to reproduce it. You will get an acknowledgement, and we ask that you give a reasonable period to fix the issue before publishing it. Testing that degrades the service, accesses data belonging to other people, or continues after you have demonstrated an issue is not acceptable and is not covered by this invitation.
Encryption in transit
Every host is served over HTTPS with a valid certificate. HTTP requests are redirected. Every host sends HSTS, so a browser that has visited once will refuse to connect over plain HTTP afterwards.
Passwords
Passwords are stored only as bcrypt hashes at cost 12. They cannot be recovered from storage, by us or by anyone who obtained the file. Nobody at QENTRA can read your password, and you will never be asked for it by email.
Sessions
Session cookies are signed, marked HttpOnly so no script can read them, and Secure so they are never sent unencrypted. Sessions expire after eight hours. Each account carries a generation number, so a single change invalidates every session ever issued to it — access can be withdrawn immediately rather than waiting for cookies to expire.
Brute-force protection
Repeated failed sign-ins from the same address are throttled. The system takes the same amount of time to reject an unknown username as a wrong password, so the form cannot be used to discover which accounts exist.
Access control
Restricted areas are gated at the server, in front of everything — pages, images, archives and documents alike — so no file can be reached by knowing its address. Directory listings are disabled everywhere, and editor backup files are refused rather than served as source.
Separation
Customer downloads and staff access use entirely separate mechanisms and separate credentials. A download session carries no privileges and cannot be used to reach an internal system.
What is not claimed
QENTRA holds no security certification and has not commissioned an external penetration test of this site. This page describes controls that are in place; it does not claim more than that.