Security & Responsible Disclosure
Effective Date: January 1, 2026 • Platform: Bio Manager (miqr.in) • Infrastructure Security Standard
1. Security Architecture Overview
Security is not an afterthought at Bio Manager (operating on miqr.in)—it is engineered into every architectural tier. Because creators and public figures entrust their primary digital gateway and QR codes to our platform, we enforce defense-in-depth protocols exceeding typical web application standards.
All network communications enforce Transport Layer Security (TLS 1.3) with perfect forward secrecy. HTTP Strict Transport Security (HSTS) with a max-age of 31,536,000 seconds is enforced across miqr.in and all sub-routes.
Session tokens utilize cryptographic JSON Web Tokens signed with high-entropy keys. Tokens are transmitted strictly via HttpOnly, SameSite=Strict, and Secure cookies, neutralizing token extraction via client-side script injection.
Before saving external links, URLs are rigorously validated against dangerous schemes (javascript:, data:) and blocked from resolving against RFC 1918 private IP addresses (10.0.0.0/8, 127.0.0.1, 192.168.0.0/16).
Sliding window in-memory rate limiters restrict authentication attempts to a maximum of 5 attempts per 15-minute window per IP address, preventing automated credential stuffing and dictionary attacks.
2. Content Security Policy (CSP) & Header Armor
Every response dispatched by our server infrastructure includes hardened HTTP security headers:
Content-Security-Policy: default-src 'self'; frame-ancestors 'self';
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
3. Responsible Vulnerability Disclosure Program
We welcome collaboration with independent security researchers, ethical hackers, and academics to keep Bio Manager secure. If you believe you have uncovered a security vulnerability in our platform, we invite you to report it responsibly.
Safe Harbor Guidelines for Ethical Researchers:
- Conduct testing solely against your own test accounts without compromising user data or degrading platform performance.
- Do not execute denial of service (DoS/DDoS) attacks, social engineering, or physical intrusion against personnel.
- Provide a reasonable timeline (minimum 30 days) for our engineering team to remediate the vulnerability before public coordination or disclosure.
- Bio Manager pledges not to pursue legal action against researchers acting in good faith within the scope of these guidelines.
4. Vulnerability Severity Classification & Remediation SLAs
Reported security disclosures are categorized adhering to the Common Vulnerability Scoring System (CVSS v3.1). We hold our engineering squads to strict remediation Service Level Agreements:
| Severity Level | CVSS v3.1 Range | Examples | Remediation SLA |
|---|---|---|---|
| P1 - Critical | 9.0 – 10.0 | Remote Code Execution (RCE), Authentication Bypass, SQL Injection leading to mass data exposure | < 24 Hours |
| P2 - High | 7.0 – 8.9 | Stored Cross-Site Scripting (XSS) on public profiles, Server-Side Request Forgery (SSRF), IDOR with state modification | < 72 Hours |
| P3 - Medium | 4.0 – 6.9 | Reflected XSS requiring social engineering, rate limit bypasses on non-auth routes, CSRF with low impact | < 7 Calendar Days |
| P4 - Low | 0.1 – 3.9 | Information disclosure of non-sensitive version banners, missing verbose security headers on non-critical endpoints | < 30 Calendar Days |
5. Disaster Recovery & Business Continuity (BC/DR)
To insulate our creators against catastrophic infrastructure failure or localized outages, Bio Manager implements an automated multi-region backup and recovery architecture:
- Continuous Transaction Logging: Point-in-time database snapshots are cryptographically signed and replicated across geographically distinct cloud availability zones every 60 minutes.
- Strict RPO & RTO Objectives: Our target Recovery Point Objective (RPO) is less than sixty (60) minutes of transaction drift, and our target Recovery Time Objective (RTO) is less than two (2) hours for total service failover restoration.
- Immutable Cold Backups: Daily snapshots are archived in append-only, write-once-read-many (WORM) compliant storage vaults protected against ransomware deletion.
- Annual Tabletop Drills: The Bio Manager engineering team performs semi-annual disaster recovery simulations and unannounced failover fire drills to validate operational readiness.
6. Security Incident Reporting Channel
Security Operations: Product Security Incident Response Team (PSIRT)
Report Inbox: security@miqr.in
PGP Key: Available upon request for encrypted communications
Initial Assessment SLA: Within 24 hours