Security at Project Weve

Security lead

Name

Mads Nicklaus Jorgenson

Role

Founder, Director and security lead, Project Weve Inc.

Company

Project Weve Inc., a Canadian federal corporation, Saskatchewan

Contact

mj@projectweve.net (subject: Security)

Report a vulnerability

If you find a vulnerability in projectweve.net or in anything Project Weve operates, email mj@projectweve.net with the subject line “Security”. Say what you found, where, and how to reproduce it, and include a way to reach you.

Please do not access other people’s data, disrupt the service, or publish details before I have had the chance to fix the problem. A machine-readable contact is at security.txt.

What this covers

Security work here covers the systems Project Weve owns and operates: this website, the build and review infrastructure, and the internal tools and dashboards behind them. I do not test systems I do not own or lack written permission to test.

How the work is done

• Write access to internal dashboards is restricted to a private network.
• The public website host uses key-only SSH, a cloud firewall, a host firewall and fail2ban.
• This site sends a strict Content Security Policy, HSTS, and frame and cross-origin protections. You can check the response headers yourself.
• The main code repository runs a secret scan (detect-secrets) before each commit, and dependencies are audited with npm audit and pip-audit. The latest passes ran on 23 October 2026.
• Changes are reviewed before they ship.