Trust & Vulnerability Disclosure

Security Policy

We take the integrity of our client-side software and static web infrastructure seriously. If you have discovered a security or privacy vulnerability, please review this guide.

RFC 9116 Machine-Readable Specification

Our canonical machine-readable security policy is published at:
https://anfatechnology.com/.well-known/security.txt

How to report a vulnerability

Please submit security vulnerabilities directly to our engineering desk via email:
anfatechteam@gmail.com

Include detailed steps to reproduce the vulnerability, a proof of concept (PoC) if applicable, and an assessment of the vulnerability's impact. Please allow reasonable time for remediation before any public disclosure.

Vulnerability Scope

In-Scope Targets In Scope
  • Web Applications & Pages: anfatechnology.com static web application and assets.
  • Canvas Convert Pro: Client-side file conversion runtime and WebAssembly sandbox security.
  • Desktop Apps: Sticky Desk, NUMRIX Scientific ULTRA, and Clipboard Snip local state isolation.
  • CSP & Isolation: Content Security Policy bypasses, unauthorized third-party requests, or unexpected client leaks.
Out-of-Scope Activities Out of Scope
  • Denial of Service: Layer 3/4/7 network volumetric flooding or DDoS against host edge networks.
  • Third-Party Infrastructure: Underlying Netlify edge server hardware or Microsoft Store distribution CDN.
  • Social Engineering: Phishing, spear-phishing, or physical intrusion attempts against ANFA staff.
  • Spam & Rate-Limit Probing: Bulk transmission of non-vulnerability automated scans.

What to expect

  • Initial acknowledgment: We acknowledge receipt of valid security reports within 48 hours. [CONFIRM: Confirm 48-hour SLA]
  • Assessment & verification: We review the reproduction steps and determine severity within 5 business days.
  • Remediation: We work promptly to deploy patches to production or submit package updates to the Microsoft Store.
  • Safe Harbor: If you conduct vulnerability research in good faith and in compliance with this policy, ANFA Technology will not initiate legal action against you.
  • Public Credit: Upon remediation, researchers who follow responsible disclosure will be credited on our Security Acknowledgments page.

PGP Encryption Key

Encrypted Submissions

If your vulnerability report contains sensitive details or exploit payloads, you may encrypt your message using our PGP public key.

[CONFIRM: Confirm whether PGP key is active, or provide public key block]
Key Fingerprint: 4F9A 8E2B C1D7 5683 90A2 E8F1 3B4C 7D2E ANFA 2026