Security posture
Last updated: 13 July 2026
This page describes how BoltScope protects your data today — the real controls and their honest limitations, no certification claims.
Current posture
- No third-party scriptsThe public website loads no analytics, tracking or external scripts.
- No data collection formsThere is no active form backend. Contact happens over email you initiate.
- No cloud persistence in the websiteThis website task added no auth, database or cloud storage. The demo workspace runs on local demo fixtures.
- Security response headersThe site sends nosniff, frame-denial, strict referrer and conservative permissions-policy headers.
What we don't claim
- We hold no formal security certifications and do not claim any.
- We have not commissioned an external penetration test at this stage and do not claim one.
- A statement about website posture is not a security guarantee for future product hosting.
Who operates BoltScope
BoltScope is a product operated by Synapse Labs Pty Ltd.
How the product protects your data
- Organisation isolation. Every record is scoped to your organisation with database row-level security, so one organisation cannot read another's data.
- Private files. Evidence and generated response packs are stored in private buckets. There are no public links.
- Server-only privileged paths. Sensitive writes (uploads, export generation, deletion) run through trusted server-side code; clients cannot bypass the checks or reach raw storage paths.
- Authenticated, short-lived downloads. Files are streamed only to signed-in members of your organisation; access is re-checked on every request and no permanent or shareable link is created.
- Activity trail. Key actions are recorded to an append-only activity log.
- Secure session cookie. Sessions use a secure,
httpOnly, same-site cookie. - Repeatable QA. A synthetic, dev-only QA harness exercises the signed-in flow against a development database and cleans up after itself.
Honest limitations
- We do not yet scan uploaded files for malware. During the controlled pilot we restrict file types and sizes and ask you to upload only documents you are comfortable sharing.
- We make no formal security-certification, penetration-test, or independent audit-assurance claims — we are not independently certified or audited.
- Sessions currently expire after a period and require signing in again; automatic refresh is a planned improvement.
Response headers
The website sends these security headers on all routes:
| Header | Value | What it does |
|---|---|---|
X-Content-Type-Options | nosniff | Stops browsers guessing content types. |
X-Frame-Options | DENY | Prevents this site being embedded in frames (clickjacking). |
Referrer-Policy | strict-origin-when-cross-origin | Limits what other sites learn when you follow a link out. |
Permissions-Policy | camera, microphone, geolocation and similar features disabled | The site requests no sensitive browser capabilities. |
Content Security Policy
We have not yet shipped a Content Security Policy header. A strict CSP on Next.js requires per-request nonces to avoid breaking framework scripts, and we chose not to ship a weak policy just to tick a box. A nonce-based CSP is documented in the repository as the recommended next hardening step.
Reporting an issue
If you find a security issue with this website, please email admin@boltscope.com.au and we will respond as quickly as we can.