Security PolicySecurityPolicy

Our Commitment

At Underwood K9, we take the security of your personal information seriously. This policy outlines the measures we use to protect your data, and how to responsibly report a security concern.

Security Measures

We implement the following safeguards to protect your data:

• Encryption in Transit: All connections use HTTPS/TLS. Unencrypted HTTP requests are automatically upgraded.
• Password Security: Passwords are salted and hashed with bcrypt. We never store or log plaintext passwords.
• Two-Factor Authentication: Email-based 2FA is available for all user accounts and required for admin access.
• Rate Limiting: Login attempts, contact form submissions, and sensitive actions are rate-limited per IP and per account to prevent brute-force and spam attacks.
• Input Validation: All user inputs are validated server-side with Zod schemas and HTML-escaped before rendering to prevent injection attacks.
• Role-Based Access Control: Admin-only routes and actions are enforced both in middleware and at the server action level.
• Content Security Policy: Strict CSP headers limit which scripts, frames, and resources can load, reducing cross-site scripting risk.
• Payment Security: All payment data is handled by Stripe (PCI-DSS Level 1 compliant). We never receive or store your full card number.
• Bot Protection: Contact and booking forms are guarded by Cloudflare Turnstile, honeypot fields, and timing-based checks.

Reporting a Vulnerability

If you discover a security vulnerability on our site, we encourage responsible disclosure. Please report it to us so we can address it promptly:

• Email contact@underwoodk9.com with the subject line "Security Report"
• Include a clear description of the vulnerability and steps to reproduce it
• Attach any relevant screenshots or proof-of-concept if applicable
• Please do not publicly disclose the issue until we have had a chance to investigate and remediate

Our Response

• We will acknowledge your report within 48 hours
• We will investigate and validate the issue promptly
• We will keep you informed of our progress toward a fix
• We will not take legal action against good-faith security researchers
• We will credit you (if desired) when the issue is resolved

Scope

The following are in scope for responsible disclosure:

• The underwoodk9.com website and all its functionality
• Authentication, session management, and account security
• Payment and booking flows
• User data exposure or access control bypass
• API endpoints and server actions

Out of Scope

• Social engineering or phishing attacks against our staff or customers
• Physical security attacks
• Denial of service (DoS/DDoS) attacks
• Vulnerabilities in third-party services we do not control (Stripe, Cloudflare, Vercel)
• Issues that require physical access to a user's device

Contact

For security-related inquiries, email us at contact@underwoodk9.com with "Security" in the subject line. For general questions, visit our contact page.