Security & Vulnerability Disclosure

01Security Posture

Security is not a single toggle — it is a continuous practice spanning design, hosting, and operations. Below are the core controls currently live in our product.

Encryption in Transit

All traffic between client and server is encrypted with TLS 1.3, HTTPS is enforced, and modern cipher suites protect against cleartext exposure.

Data Minimization

We collect only the minimum data needed to deliver eSIM service. No passport or sensitive identity documents are required; data is retained on a need basis and pruned regularly.

Role-Based Access Control

Our backend uses an RBAC model, assigning duties under least-privilege principles. Sensitive actions are gated by permission checks and audit logging.

Cloudflare Edge Infrastructure

The application is hosted on Cloudflare's global edge, inheriting DDoS mitigation, WAF, and global acceleration — reducing the attack surface of self-managed infrastructure.

02Data & Payment Handling

For payments, we rely on qualified third-party payment processors to handle charges. CFJ-LINK does not store full cardholder data (such as full PAN or CVV), fundamentally reducing the blast radius of any payment-data exposure.

Key & credential isolation: Service keys and API credentials are injected via the platform's secret management — never hardcoded in frontend code, never shipped to the page.
No cardholder data retained: Card details are handled by professional payment processors; CFJ-LINK does not retain full cardholder data.
In-transit & at-rest protection: Sensitive data is encrypted in transit; storage is minimized on a need basis and read access is restricted by access controls.

Honest note: We continuously advance our security engineering, but we have not yet obtained any third-party security certification (such as SOC 2 / ISO 27001). This page makes no claim of any certification that is not complete. In-progress items are listed below under "In-Progress Items."

03Responsible Disclosure Program

We value the work of the security research community. If you discover a vulnerability that may affect the security of CFJ-LINK users or systems, we sincerely invite you to report it responsibly under this program, giving us a reasonable confidentiality window to investigate and remediate.

We currently operate this program on a best-effort basis: there is no public monetary bug bounty, and we do not promise fixed payouts. We will thank you for valid, first reports of genuine vulnerabilities, and credit you publicly with your consent.

04Scope

In Scope

Our website cfj-global.com and its subdomains
The customer app web-app.cfj-global.com
Public-facing API endpoints and authentication logic
Authentication, session management, and broken-access issues

Out of Scope / Not Accepted

Denial-of-service (DoS / DDoS) testing against production
Social engineering, phishing, or physical attacks on staff
Issues within third-party services (e.g., payment processors, Cloudflare)
Purely theoretical reports or scanner noise without exploitable impact

05Safe Harbor

As long as you conduct security research in good faith and in accordance with this program, we commit not to initiate or support legal action against you for your research, and to treat your report as a good-faith act. To qualify for this protection, your research must meet the following conditions:

Do not destroy or exfiltrate data: Do not delete, modify, exfiltrate, or disclose any user data that is not your own; stop as soon as a vulnerability is confirmed and avoid escalating impact.
Do not harm availability: Do not run tests that could cause service disruption, data loss, or degradation (e.g., DoS, large-scale brute force).
Use only your own accounts: Validate only against accounts you own or test accounts you are expressly authorized to use; respect others' privacy.
Allow a reasonable remediation window: Do not publicly disclose vulnerability details before we confirm and reasonably remediate; coordinate the disclosure timeline with us.

Boundaries: Safe Harbor does not waive obligations toward third parties, and does not apply to clearly malicious or extortionate conduct. If you are unsure whether a test is in scope, please confirm with us first at [email protected].

06Reporting & Response Process

Submit a Report

Email the vulnerability to [email protected]. Please include reproduction steps, affected URLs/endpoints, an impact assessment, and any proof of concept (PoC). Clear, reproducible descriptions are appreciated.

Acknowledgement

We acknowledge receipt as promptly as we can on a best-effort basis. Given our small team, we do not promise a fixed number of response hours, but we treat every valid report sincerely.

Investigation & Triage

We reproduce and assess severity and impact, reaching out for more information where needed. Please do not disclose details publicly during validation.

Remediation & Coordinated Disclosure

We remediate in risk-priority order and coordinate a disclosure timeline once a fix lands. With your consent, we are glad to credit you in our acknowledgements.

Security Contact: [email protected]
Preferred-Languages: en, zh
Disclosure-Policy: Coordinated, best-effort response

07In-Progress Items (Stated Honestly)

To avoid any misrepresentation, the table below separates what is already live in the product from what is in progress and not yet complete. We do not claim that any incomplete certification or mandatory policy is already in effect.

TLS 1.3 in transit / enforced HTTPSTransport encryption between client and server

Live

Data minimization & RBAC modelMinimal collection + least-privilege access control

Live

Cloudflare edge hosting & baseline protectionDDoS mitigation / WAF / global acceleration

Live

Account two-factor authentication (2FA / MFA)In progress as an optional enhancement; not yet enforced

In Progress

Third-party security certification (SOC 2 / ISO 27001)Not yet obtained; to be evaluated as the business grows

In Progress

This page is updated as the product evolves. When an in-progress item lands, we update its status to "Live."

08Contact the Security Team

Found a security issue?

Please send security-related reports to our dedicated security inbox first. For general product questions, use the support channel.

[email protected] Telegram @cfjglobal_bot Customer Support