Responsibility / Security

Clear boundaries.
Evidence before assurance.

This public website is separate from the Astra Civic application and private environments. No production security certification or independently verified control framework is claimed.

The public website boundary

The local Northfield experience contains fictional sample content and temporary client state. It does not authenticate users, connect to a CMS, access private services or expose municipal records. Product descriptions and roadmap items are not evidence of production security controls.

Enquiry safeguards

The enquiry endpoint validates field types and lengths, requires a permitted origin, rejects populated honeypot fields, limits request size and applies temporary attempt limits. It forwards validated data only to an operator-configured HTTPS endpoint. Optional server credentials are never sent to the browser.

In-process rate limits reset across restarts and do not coordinate across serverless instances. Before public lead collection, use a trusted proxy configuration and a durable edge or shared rate limit. The chosen provider’s security and privacy responsibilities also need review.

Browser and application controls

The application sends content-type, framing, referrer, permissions, transport and content security headers. The current content security policy permits inline scripts for Next.js rendering; a nonce-based policy is a potential hardening task requiring a deliberate rendering tradeoff. Headers and dependency checks are safeguards, not a substitute for testing.

What requires production evidence

Identity and permissions, audit records, encryption arrangements, backup restoration, vulnerability management, incident response, data location and third-party assurance must be assessed in the actual platform environment. No SOC 2 report, penetration test result, availability guarantee or formal certification is represented here.

Reporting a concern

Use the configured contact channel to request a suitable private route for security details. Do not submit exploit payloads, credentials, sensitive records or details that could expose another person through the general enquiry form.

A monitored security reporting address, triage ownership and response process are production release requirements. This website does not publish a bug bounty, testing authorization or response guarantee.