Security at MimmoBook

    We take the security of our customers, their staff, and their guests seriously. This page describes our security program, how we develop and ship code safely, and how to report a vulnerability you have found.

    Reporting a vulnerability

    If you believe you have found a security issue in MimmoBook, please report it privately to our security contact: . The address is hidden from automated crawlers and revealed on click, so bots cannot scrape it from this page.

    What to expect: we acknowledge your report within 2 business days and aim to give a substantive update within 5 business days. Please include the affected URL, the steps to reproduce, the impact you believe it has, and your preferred credit name. Reports without reproduction steps, automated scanner output with no verified impact, and sales or marketing messages sent to this address are not answered.

    Please give us reasonable time to investigate and fix the issue before any public disclosure. We will credit you in our acknowledgments section unless you ask us not to.

    A machine-readable contact is also published at /.well-known/security.txt.

    Safe harbor

    We will not pursue legal action against researchers who act in good faith, avoid privacy violations, do not degrade the service, and do not access more data than necessary to demonstrate the issue. Do not test against other customers' tenants, and never use real personal data.

    Out of scope

    • Reports based solely on automated scanner output without a working proof of concept.
    • Missing security headers without a demonstrated impact.
    • Rate limiting or denial-of-service attempts against production.
    • Social engineering of MimmoBook staff or customers.
    • Physical attacks.
    • Vulnerabilities in third-party services we depend on (please report those upstream).

    Our security program

    • Tenant isolation: Every table that holds customer data has Row Level Security enabled and tenant-scoped policies, verified by automated cross-tenant tests on every pull request.
    • Authentication: Email + password with a 12-character minimum and live Have I Been Pwned breach detection. MFA available for all users and mandatory for system administrators.
    • Encryption: TLS 1.2 or higher in transit; AES-256 at rest for database and object storage.
    • Audit logging: All sensitive changes are recorded with a 90 day retention and reversible history.
    • Continuous testing: Pull requests run dependency audit, CodeQL static analysis, RLS cross-tenant adversarial tests, storage attack tests, and edge-function security tests. Failures block merge.
    • Backups: Encrypted daily backups, 30 day rolling.
    • Subprocessor governance: See subprocessor list. 30 day prior notice for any change.

    Transparency artifacts

    • Software Bill of Materials (SBOM): CycloneDX 1.5 format, regenerated on every dependency change. Available on request from our security contact: .
    • Penetration testing: Annual third-party penetration test plus targeted tests after major architectural changes. Summary report available under NDA.
    • Secure development lifecycle: Documented SDLC covering threat modeling, code review, dependency management, secret handling, and incident response.
    • Vulnerability scanning: Daily dependency audit and weekly SBOM regeneration in CI. Findings at high or critical severity block deploy.

    Acknowledgments

    We thank the security researchers who have helped us improve MimmoBook. Names are added here with explicit consent after a coordinated disclosure.