Public posture
The static product surface uses Cloudflare Pages security headers and publishes a canonical security.txt contact route.
SECURITY
Security has an operating boundary.
Blackbox security material separates public posture, vulnerability reporting and explicitly authorized active testing.
Disclosure
Suspected vulnerabilities can be reported to security@mediatorsolutions.io. A report does not authorize active testing.
Active validation
Testing requires written scope, target authority, permitted methods, stop conditions, evidence handling and Rules of Engagement.
Proof
Findings preserve reproduction conditions and a bounded retest path rather than implying certification.