1. Security design
The public site uses static HTML, local style and script files, no public database, no login, no contact form, no advertising technology and no third-party analytics. Security headers and HTTPS enforcement are included in the deployment configuration.
- Content Security Policy restricting resources to the site itself.
- Protection against framing, content-type confusion and unnecessary browser permissions.
- No external font, analytics or advertising requests.
- A published security.txt contact route for responsible reports.
2. Responsible disclosure
If you believe you have identified a security weakness affecting this website, email dhowcapital@bramston.co with the subject “Website security report”.
- Describe the issue, affected URL and the steps needed to reproduce it.
- Include evidence sufficient to understand the risk, while minimising personal data.
- Do not access, alter, retain or disclose data beyond what is strictly necessary to demonstrate the issue.
- Do not use denial-of-service, social engineering, phishing, destructive testing or automated scanning at a disruptive rate.
- Allow reasonable time for investigation and remediation before public disclosure.
3. Scope and limits
This policy applies to the public website at dhowcapital.bramston.associates. It does not authorise testing of Bramston systems, email infrastructure, third-party services, personal devices or any system not expressly owned and operated for this website.
No website can be guaranteed completely secure. Dhow Capital may preserve relevant logs and communicate with service providers or authorities where necessary to investigate malicious or unlawful activity.