forge-sec Security

Our Security Program

forge-sec follows a risk-based security program designed around prevention, detection, response, and continuous improvement. We evaluate safeguards according to the sensitivity of the information, the nature of the Services, and relevant operational risks.

Security responsibilities are incorporated into product development, infrastructure operations, access management, incident handling, and supplier oversight.

Shared Responsibility

Protecting a security testing environment is a shared responsibility. forge-sec works to secure the platform and supporting infrastructure, while customers control their users, credentials, testing scope, connected systems, and the data they submit.

Customers should assign access according to job responsibilities, review authorized users regularly, protect credentials, configure integrations carefully, and ensure that all testing targets are properly authorized.

Platform and Infrastructure Protection

forge-sec applies layered safeguards intended to reduce unauthorized access, prevent misuse, isolate customer activity, and protect the availability and integrity of the Services.

Infrastructure and application controls are reviewed as the platform changes. Security-relevant configuration, service health, and operational events may be monitored to identify conditions requiring investigation.

• Layered controls across application, infrastructure, identity, and operational boundaries.
• Environment and service configuration managed through controlled processes.
• Monitoring designed to identify suspicious activity and service degradation.
• Logical separation of customer workspaces and authorized testing activity.

Data Protection

forge-sec treats findings, validation evidence, scan configurations, asset information, reports, and related workspace content as sensitive customer security data.

The Services are designed to protect data in transit and at rest using appropriate encryption and platform safeguards. Access to customer data is limited to authorized purposes such as providing support, maintaining the Services, investigating security issues, or meeting legal obligations.

Retention and deletion depend on service configuration, contractual commitments, legal requirements, and the type of information involved.

Identity and Access Management

Access to forge-sec systems is governed by the principles of least privilege and business need. Permissions are intended to be assigned according to role and reviewed as responsibilities change.

Administrative and production access is restricted and subject to appropriate authentication, authorization, and oversight. Customers remain responsible for managing workspace users and promptly removing access that is no longer required.

Secure Development

Security is considered throughout the software development lifecycle. Changes are developed, reviewed, tested, and released through managed workflows intended to reduce defects and unauthorized modification.

forge-sec evaluates application and dependency risk using a combination of engineering review, automated analysis, testing, and remediation processes appropriate to the affected component.

• Security-aware design and threat consideration for material changes.
• Peer review and controlled change-management practices.
• Automated checks and testing integrated into delivery workflows.
• Prioritized remediation based on severity, exploitability, and exposure.

Vulnerability Management

forge-sec evaluates security issues affecting the platform and prioritizes remediation according to risk. Relevant factors may include severity, exploitability, exposure, available mitigations, and potential impact on customers.

We review information from internal testing, monitoring, software dependencies, service providers, and responsible external reports. When an issue affects customers, we take steps appropriate to the risk and available evidence.

Security Monitoring and Incident Response

forge-sec maintains processes intended to detect, assess, contain, investigate, and recover from security events. Alerts and operational signals are reviewed according to their context and potential impact.

If we determine that a security incident affects customer information, we will communicate with impacted customers in accordance with applicable law and contractual obligations. Notifications may include known impact, actions taken, and practical steps customers should consider.

Availability and Recovery

forge-sec plans for service interruptions and operational failures based on the importance of affected systems. Resilience, backup, restoration, and recovery measures are selected according to service architecture and business risk.

We review operational incidents to identify improvements that can reduce recurrence, shorten recovery time, or strengthen monitoring and response.

People and Operational Security

Personnel with access to sensitive systems or information are expected to follow security and confidentiality requirements appropriate to their responsibilities.

Access is granted based on business need, adjusted when roles change, and removed when it is no longer required. Security awareness and operational procedures support consistent handling of customer information and security events.

Service Provider Security

forge-sec relies on selected service providers for capabilities such as infrastructure, communications, support, analytics, and business operations. We consider the nature of the service and the information involved when evaluating supplier risk.

Providers that handle sensitive information are expected to follow applicable contractual, confidentiality, privacy, and security obligations. We limit access to what is reasonably necessary for the service they provide.

Customer Security Guidance

Customers can materially strengthen their forge-sec environment by applying sound identity, endpoint, integration, and testing-scope practices.

• Use unique credentials and strong authentication controls.
• Grant the minimum workspace permissions required for each role.
• Review users, integrations, scan targets, and exported reports regularly.
• Keep connected systems and endpoints appropriately patched and monitored.
• Report suspected account compromise or unexpected platform activity promptly.

Responsible Disclosure

We welcome good-faith reports that help us protect forge-sec and our customers. If you believe you have found a security issue in a forge-sec-owned system, report it privately and provide enough detail for us to understand and reproduce the concern.

Do not access customer data, disrupt services, use destructive testing, or publicly disclose an unresolved issue. We will review credible reports and communicate as appropriate during investigation and remediation.

Contact Security

For security questions, suspected platform misuse, or responsible disclosure, contact the forge-sec team at info@forge-sec.com. Include a clear description, the affected service or URL, reproduction details, and your preferred contact information.