Security
Security is part of the product
Competition integrity and data protection are not afterthoughts on MusterBox. Here is the security posture as it stands today.
Current posture
What is already in place
TLS everywhere
All traffic between visitors, the API and the site is encrypted in transit.
No secrets in the browser
Credentials and API keys never ship inside the public bundle. Anything sensitive lives server-side.
Sanitized editorial content
CMS markdown is rendered through strictly filtered HTML — no script injection, no arbitrary embeds.
Measured exposure
Contact endpoints are validated, rate limited and honeypot protected.
Practices
How we operate
Dependency review
Production dependencies are pinned and checked as part of the build pipeline.
Least privilege
Admin and deploy access is granted per-person, and revoked when someone leaves.
Public by default
When something is security-relevant and safe to share, we publish rather than hide.
Found a vulnerability?
Report it privately and responsibly through the contact form — we reply to every serious report.