Annual Cybersecurity Disclosure 2026

1. Purpose and status

This disclosure describes how PlausiDen identifies and manages cybersecurity risk in the systems it operates, who is responsible for that work, what changed during the reporting period, and whether any incidents occurred. It is published by PlausiDen and has not been audited by a third party. PlausiDen does not hold an ISO/IEC 27001 certificate or a SOC 2 report, and does not operate a paid bug bounty program.

2. Scope

Systems in scope. One dedicated server leased from Hetzner Online GmbH and administered only by PlausiDen, in service since May 4, 2026. It hosts plausiden.com and plausiden.org; websites PlausiDen hosts for clients, including prosperityclub.com for Prosperity Club; email for plausiden.com; and PlausiDen's client-records system, file storage and website analytics.

Out of scope. Services run by other companies that we or our clients use: Cal.com for booking calls, Follow Up Boss for real-estate clients, Google Analytics on prosperityclub.com, and the email service for prosperityclub.com, which is hosted by a separate provider.

Separate infrastructure. SacredVote (sacred.vote), PlausiDen's election-security project, runs on separate servers behind Cloudflare. Section 6 covers it; the controls in section 4 describe the dedicated server only.

3. Governance

Accountability. Deborah Armstrong, majority owner, is accountable for cybersecurity risk and approves this disclosure each year.

Operations. William Armstrong, founder and lead engineer, runs security operations: access control, patching, monitoring, backups, change control and incident response. Reports sent to security@plausiden.com go to him.

4. Risk management and controls

Access. Administrator access to the server requires an SSH key; password logins, keyboard-interactive logins and direct root logins are disabled. A WireGuard VPN provides a private network for administration. Staff sign in to the client-records system and to file storage with passkeys.

Encryption. Websites are served over TLS 1.2 and 1.3 only; TLS 1.0 and 1.1 connections are refused. Browsers are told to use HTTPS for two years (HSTS, with preload). The system disk and the storage pool are encrypted at rest (LUKS).

Network. A host firewall (nftables) filters traffic. CrowdSec blocks addresses that show abusive behavior, and Suricata inspects traffic for known attack patterns.

Patching. Operating-system security updates are installed automatically (unattended-upgrades).

Change control. Every change to our websites must pass an automated gate before release: a scan for committed secrets (gitleaks), static analysis (Semgrep) and a dependency and configuration scan (Trivy), plus each site's own tests. Code pushed to GitHub is scanned for secrets before it leaves the server.

Monitoring. A daily scan checks stored credentials for reuse and overdue rotation. A daily host scan compares the network services listening on the server with a recorded baseline and reports anything new. Scheduled jobs are checked to confirm they actually run.

Backups. The storage pool is snapshotted daily. Email and the most important datasets are copied daily to a separate encrypted drive, and an automatic job verifies that the backups can be read. Backups are currently kept within the same server; an off-site copy is not yet in place.

Logging. Web server logs leave out cookies, authorization headers and other request headers that could identify a visitor, and replace each IP address with a short code. What our sites record is set out on our privacy page.

5. Vulnerability management and disclosure

Reporting. Security problems can be reported to security@plausiden.com, which is also published in our security.txt file (RFC 9116). We read every report, fix what we confirm, and tell the reporter what we found.

Issues found and fixed in the period. September 6, 2026: web server logs were found to be recording cookie and authorization headers; they are no longer recorded, and an hourly check confirms it. October 13, 2026: the token for admin data exports moved from the address bar to a request header and is compared in constant time. October 29, 2026: an open redirect in plausiden.com's handling of addresses ending in a slash was found and fixed the same day.

6. Incidents

Compromises. No system PlausiDen operates was compromised during the reporting period, including plausiden.com, SacredVote and the websites we host for clients such as prosperityclub.com, and we know of no unauthorized access to client data.

Attempts detected and stopped. Suricata recorded repeated scans from Mirai-variant botnets between September 10 and October 27, 2026; none gained access. Phishing email sent to our addresses was caught by the mail server's spam filtering (rspamd). As of November 3, 2026, CrowdSec was blocking about 14,500 addresses: most from its shared community blocklist (about 9,100 web scanners, 5,200 SSH brute-force sources and 200 spam senders), plus a few dozen it caught probing our own sites for admin pages, sensitive files and WordPress weaknesses.

7. History of controls during the period

Oct 21, 2025

plausiden.com registered.

Apr 24, 2026

Work on the plausiden.com website begins.

May 4, 2026

Dedicated server commissioned at Hetzner, with an encrypted system disk.

May 16, 2026

Automatic security updates enabled.

May 17, 2026

CrowdSec blocking of abusive traffic in place.

May 31, 2026

Daily snapshots of the storage pool begin.

Jun 14, 2026

Daily email backups begin.

Jul 2, 2026

WireGuard VPN set up for administration.

Jul 7, 2026

Automated release gate (secrets, static analysis, dependency scan) and daily host scan introduced.

Aug 2026

prosperityclub.com moves onto PlausiDen's server.

Sep 6, 2026

Credential headers removed from web server logs; automatic backup verification begins.

Sep 7, 2026

Suricata intrusion detection installed; daily copy of key datasets to a separate drive begins.

Sep 8, 2026

Passkey sign-in for the client-records system.

Sep 24, 2026

Daily credential-hygiene scan begins.

Oct 1, 2026

Proof-of-work spam protection on the contact and feedback forms.

Oct 13, 2026

Privacy page published; admin export token hardened.

Oct 2026

Passkey sign-in for file storage.

Oct 29, 2026

Open redirect found and fixed the same day.

Nov 3, 2026

This disclosure published.

8. Related

Prosperity Club publishes its own disclosure for the website we run for it: the Prosperity Club cybersecurity disclosure. What our sites record about visitors is on our privacy page. Our security contact details are also published in our security.txt file.