EVMSIEV MULTI-SECTOR INVESTMENT COMPANY LIMITED — home

Security

Reporting a vulnerability.

If you have found a security issue in this site, we want to hear about it, and we will not pursue you for telling us.

How to report

Write to security@evmsi.com with enough detail to reproduce the issue. We aim to acknowledge reports within three business days.

Safe harbour

If you make a good-faith effort to comply with this policy during your research, we will consider it authorised, we will work with you to understand and resolve the issue quickly, and we will not recommend or pursue legal action.

In scope

  • 01This website and its subdomains.
  • 02The contact endpoint at /api/contact.
  • 03Any issue allowing script execution, content injection, or bypass of the Content Security Policy.

Out of scope

  • 01Denial of service, volumetric testing, or any activity degrading availability for others.
  • 02Social engineering of our people, partners or suppliers.
  • 03Physical attacks against our offices or staff.
  • 04Reports generated solely by an automated scanner, without a demonstrated impact.
  • 05Missing hardening headers with no demonstrated exploit path.

Our posture

This site is deliberately built with almost no attack surface. It loads no third-party script, style, font, frame or endpoint; it takes exactly one form submission; and it stores nothing about visitors. The measures below are applied to every response.

  • 01A nonce-based Content Security Policy with strict-dynamic — no inline or third-party script can execute.
  • 02HTTP Strict Transport Security with a two-year max-age, subdomains included, preload-eligible.
  • 03Framing denied outright via both frame-ancestors and X-Frame-Options.
  • 04Cross-origin isolation: same-origin opener, resource and embedder policies.
  • 05A Permissions-Policy that surrenders every device capability the site does not use, including for our own origin.
  • 06Server-side validation, body-size limits, origin checking and per-address rate limiting on the contact endpoint.
  • 07No third-party analytics, tag manager, advertising pixel or session recorder — anywhere.

Please do not

Access, modify or delete data that is not yours; degrade the service for other people; or publish details of an unresolved issue before we have had a reasonable opportunity to fix it.

Contact

EV MULTI-SECTOR INVESTMENT COMPANY LIMITED
security@evmsi.com