Security & vulnerability reporting

Reporting a problem

Send security reports to communications@utahbar.org. This is the Utah State Bar's general communications address. It is not a dedicated security mailbox and is not described here as continuously monitored.

Published reporting policy URL: https://urntestsite.com/security. The same values are published in machine-readable form at /.well-known/security.txt.

No safe-harbor or authorization commitment is made on this page, and no acknowledgement or response time is promised. Any legal safe-harbor language must be drafted and approved by counsel before it is published.

Protections currently in place

• Row-level security is enabled and deny-by-default on application tables.
• Administrative actions are authorized on the server against a separate roles table; the browser cannot grant itself a role.
• Administrator accounts are created by invitation only; there is no public sign-up.
• Administrator sign-in requires a time-based one-time passcode (TOTP) from an authenticator app in addition to a password. Server-side privileged actions fail closed unless the session has completed that second factor.
• Administrator password attempts run through a server-controlled path with a deny-by-default database throttle keyed by a one-way digest of the account identifier. No email address, password, IP address or browser fingerprint is stored for throttling, and error messages are generic so accounts cannot be enumerated.
• Response headers set an enforcing Content-Security-Policy (no report-only mode), X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a restrictive Permissions-Policy, and clickjacking protection via frame-ancestors 'none' plus X-Frame-Options: DENY.
• The public usage counter is allowlisted, size-capped and rate-limited.
• Coarse usage records and search submissions are deleted after 400 days by a scheduled database job. Chat text is never stored.

External CAPTCHA (Cloudflare Turnstile) is not enabled today. A verification hook exists in the sign-in path and activates only when the operator supplies a secret key; until then it is not claimed as a protection.

Scope of the sign-in throttle. Our administrator sign-in screen always submits through a server-controlled path that applies attempt limits and automation checks. That is an application-level control: the hosted authentication API is itself a public endpoint, so requests made directly to it, outside this site, are governed by the authentication provider’s own rate limiting and CAPTCHA settings rather than by our throttle. We state this scope plainly rather than overstating the protection.

Hosting, storage, and certifications

• Encryption in transit: the site and its database connections are served only over HTTPS (TLS).
• Encryption at rest: application data is stored in a managed database service whose provider encrypts stored data at rest. The project does not add its own separate encryption layer on top of that.
• Isolation: the project uses its own database instance. Pages and server code run on a shared, multi-tenant edge hosting platform; we do not claim dedicated or physically isolated infrastructure.
• Database controls: row-level security, server-side role checks, and a scheduled retention job, as described above.
• Security scanning: automated checks of database access rules, dependencies, and code are run during development. These are not an independent penetration test.
• AI chat: questions typed into Ask URN are sent to a third-party AI model provider to generate a reply. The site does not save chat text.

Certifications. The Utah Resource Navigator itself has not been independently audited and does not hold SOC 2 Type II, ISO 27001, or any similar certification. Some underlying hosting and database providers publish their own attestations; those reports cover the provider's controls, not this application, and should be requested from the provider directly.