Skip to content

Legal

Security

Last updated 18 September 2026

Security matters to us and to the businesses we build software for. This page explains how we protect this website and how to tell us about a vulnerability you’ve found.

How we protect this website

  • Encrypted everywhere. The site is served only over HTTPS, and browsers are told to always use a secure connection (HSTS).
  • Security headers. A Content Security Policy limits where scripts and other resources can load from, and further headers stop other sites from framing our pages, prevent content-type sniffing and restrict browser features we don’t use.
  • A small attack surface. Pages are pre-built static files. There is no website database, no user accounts and no public admin panel.
  • A hardened contact form. It accepts submissions only from our own pages, validates and filters every field, blocks spam bots and limits repeat submissions. Enquiries go straight to our mailbox and aren’t stored on the web server.
  • Minimal third parties. Fonts and scripts are self-hosted. The only external service is cookie-free Ahrefs Web Analytics, and the site sets no cookies.
  • Secrets kept out of code. Credentials are kept out of source control and blocked from being served, and we keep dependencies up to date.

Reporting a vulnerability

If you believe you’ve found a security vulnerability in this website or in software we’ve built, please email info@amj-tech.co.nz with the subject “Security report”. Please include:

  • the page, URL or product affected;
  • a description of the issue and its potential impact;
  • the steps to reproduce it, with screenshots or proof-of-concept code if you have them; and
  • how we can contact you.

What we ask of you

  • Give us reasonable time to investigate and fix the issue before you share it publicly.
  • Don’t access, change or delete data that isn’t yours, and stop as soon as you have enough to demonstrate the issue.
  • Don’t run denial-of-service tests, send spam through our forms, or use social engineering or physical attacks.
  • If the issue affects one of our clients’ products, report it to us and don’t test their live systems beyond what’s needed to show the problem.

What you can expect from us

  • We’ll acknowledge your report and keep you updated while we investigate.
  • We’ll let you know when the issue is fixed, and we’re happy to credit you if you’d like.
  • We won’t take legal action against research carried out in good faith and in line with this page.

We don’t currently run a paid bug bounty programme.

Clients

If you’re a client and have a security concern about software we’ve built or support for you, contact your project lead directly or email us and we’ll treat it as a priority.