EVMSI

Something went wrong.

EVMSIEV MULTI-SECTOR INVESTMENT COMPANY LIMITED — home

Security

Reporting a vulnerability.

If you have found a security issue in this site, we want to hear about it, and we will not pursue you for telling us.

How to report

Write to security@evmsi.com with enough detail to reproduce the issue. We aim to acknowledge reports within three business days.

Safe harbour

If you make a good-faith effort to comply with this policy during your research, we will consider it authorised, we will work with you to understand and resolve the issue quickly, and we will not recommend or pursue legal action.

In scope

  • 01This website and its subdomains.
  • 02The contact endpoint at /api/contact.
  • 03Any issue allowing script execution, content injection, or bypass of the Content Security Policy.

Out of scope

  • 01Denial of service, volumetric testing, or any activity degrading availability for others.
  • 02Social engineering of our people, partners or suppliers.
  • 03Physical attacks against our offices or staff.
  • 04Reports generated solely by an automated scanner, without a demonstrated impact.
  • 05Missing hardening headers with no demonstrated exploit path.

Our posture

This website uses server-side access checks, limited data collection and restrictive browser policies. Private preview sessions and abuse counters are stored temporarily. Security controls reduce risk and require ongoing review.

  • 01A nonce-based Content Security Policy permits authorized application scripts and restricts other script execution.
  • 02HTTP Strict Transport Security with a one-year maximum age for this hostname.
  • 03Framing denied outright via both frame-ancestors and X-Frame-Options.
  • 04Cross-origin isolation: same-origin opener, resource and embedder policies.
  • 05A Permissions-Policy that surrenders every device capability the site does not use, including for our own origin.
  • 06Server-side validation, body-size limits, origin checking and a shared submission budget on the contact endpoint.
  • 07No third-party analytics, tag manager, advertising pixel or session recorder — anywhere.

Please do not

Access, modify or delete data that is not yours; degrade the service for other people; or publish details of an unresolved issue before we have had a reasonable opportunity to fix it.

Contact

EV MULTI-SECTOR INVESTMENT COMPANY LIMITED
security@evmsi.com