Security Policy

Last updated: April 12, 2026

Security Policy and Vulnerability Disclosure

peelpot.co.uk is committed to maintaining the security and privacy of users and their data. This page describes the security measures we have in place and how to report a security concern.

Security Measures

The Portfolio Management System implements the following controls to protect user data and system integrity:

Authentication and Access Control

  • Passwords are stored using bcrypt hashing with a cost factor of 12. Plain-text passwords are never stored or logged.
  • Optional Two-Factor Authentication (TOTP) is available to all users, compatible with standard authenticator apps (e.g., Google Authenticator, Microsoft Authenticator, Authy). TOTP uses 6-digit codes on a 30-second cycle with replay-attack protection and 10 single-use recovery codes.
  • Login attempts are rate-limited: accounts are locked for 15 minutes after 5 consecutive failed attempts. IP-based tracking is used to detect brute-force patterns.
  • Sessions are stored server-side in the database (not in files or cookies). Session cookies are set with HttpOnly and SameSite=Strict flags and expire after 2 hours of inactivity.
  • Role-based access control with over 100 granular permissions ensures users can only access data and functions relevant to their role.

Data Protection

  • All form submissions are protected by CSRF tokens, regenerated on each request.
  • All database queries use PDO prepared statements with parameter binding, preventing SQL injection.
  • User input is validated and sanitised at system boundaries.
  • Uploaded files are validated by MIME type (not just extension) and scanned for viruses and malware using ClamAV or VirusTotal where configured. Infected or policy-flagged files may be quarantined from user access and can be deleted after administrative review.
  • Uploaded files are encrypted at rest using AES-256-GCM when file-encryption mode is enabled.
  • File uploads are limited to approved types and a maximum size of 50 MB.
  • Database backups are encrypted using AES-256-GCM and retained for 90 days.

Monitoring and Audit

  • All user actions are recorded in a comprehensive audit log, including action type, timestamp, IP address, user agent, and a risk classification. Logs are accessible only to administrators.
  • File moderation actions (quarantine, release, and deletion) are written to the audit trail with the acting administrator and reason/context where provided.
  • All login attempts (successful and failed) are logged with IP address and timestamp.
  • Audit logs are retained for 90 days in active storage, then archived.

Breach Response

In the event of a confirmed personal data breach, we will notify the Information Commissioner's Office (ICO) within 72 hours where required, and affected users without undue delay.

Vulnerability Disclosure Policy

We welcome reports from security researchers and users who identify potential vulnerabilities. We ask that you act responsibly and follow the guidelines below.

Scope

This policy covers systems and services operated directly by peelpot.co.uk, including the main web application and its APIs. Third-party services (hosting infrastructure, email providers, Cloudflare) are outside scope — please report vulnerabilities in those services directly to the relevant provider.

Guidelines for Researchers

  • Act in good faith. Do not access, modify, or delete data beyond what is strictly necessary to demonstrate the vulnerability.
  • Do not perform denial-of-service attacks, automated bulk scanning, or brute-force attempts.
  • If you encounter personal data belonging to other users, stop immediately and report without accessing further data.
  • Keep details of vulnerabilities confidential until we have confirmed the issue is resolved.
  • Do not attempt social engineering, phishing, or physical attacks.

Safe Harbour

If you report a vulnerability in good faith and comply with these guidelines, we will:

  • Consider your research authorised and not pursue legal action against you
  • Not report you to law enforcement
  • Use the information you provide solely to investigate and fix the vulnerability

If a third party initiates legal proceedings against you for research conducted within these guidelines, we will take reasonable steps to confirm that your actions were authorised.

How to Report

Email your report to: security@peelpot.co.uk

Please include:

  • A clear description of the vulnerability
  • Steps to reproduce
  • The potential impact
  • Any supporting screenshots or proof-of-concept (do not include actual user data)

You may report anonymously, though providing contact details helps us follow up with questions or updates.

What to Expect

  • Acknowledgement of your report within 5 business days
  • Triage and validation as soon as practicable
  • Regular updates on progress
  • Remediation based on severity, prioritising critical and high-risk issues
  • Credit on our acknowledgements page once the issue is resolved, if you would like it

We do not currently offer monetary rewards.

Coordinated Disclosure

We request that you allow us a reasonable period (typically 90 days from acknowledgement) to remediate the issue before any public disclosure. We will work with you on a mutually agreeable timeline.

Contact

Security reports: security@peelpot.co.uk
General enquiries: dnbassett@peelpot.co.uk