Gen318 holds vendor credentials for customer plant, the operating records that programme and grant decisions are calculated from, and personal data covered by the Nigeria Data Protection Act. A defect here has consequences off the screen, so we would much rather hear from you than not.
Reporting a vulnerability
Email security@gen318.com. Please do not open a public issue or post a security defect publicly.
We will acknowledge your report within 3 working days and give you our assessment within 10 working days. We will tell you when it is fixed. We credit reporters who want to be credited, and we will not pursue legal action over good-faith research that stays within the boundaries below.
Include enough detail to reproduce the issue: the request, the response, and what you expected.
Please do
- Report privately and give us a reasonable window to fix the issue before you disclose it.
- Stop as soon as you reach data that is not yours, and tell us what you saw. That is a report, not a finding to develop further.
Please do not
- Run denial-of-service or load tests against production.
- Touch dispatch, actuation or any control surface on a live site. A mini-grid serves real households; an interrupted supply is not a lab result.
- Access, modify or retain any customer's operational or personal data.
- Social-engineer our staff or customers.
If you need somewhere to test destructively, write to us first. We would rather discuss a separate environment than have you probe production.
Scope
| In scope | Notes |
|---|---|
| app.gen318.com | Production operator console and API. It holds live customer data, so test non-destructively only. |
| gen318.com | This website |
| Gen318 edge node software | Report issues rather than testing on equipment in the field |
Out of scope: third-party services we connect to (report to them directly), such as Odyssey Energy Solutions, SparkMeter, Victron Energy, Huawei FusionSolar and Growatt; and findings that require physical access to a site.
What we have and have not done
In place: database-enforced separation between customers, with the application refusing to start if its database connection could bypass it; Argon2id password hashing with breached-password checks; short-lived access tokens with refresh rotation and reuse detection; refresh tokens in httpOnly cookies with CSRF protection; TOTP multi-factor authentication with single-use recovery codes; AES-256-GCM field encryption with key rotation; append-only audit logging; blocking dependency, code and secret scanning; signed container images verified before deployment; and encrypted off-site backups with a rehearsed restore.
Not yet: an independent penetration test, a third-party security certification (such as SOC 2 or ISO 27001), and a production monitoring stack in a separate failure domain. We would rather say so than imply otherwise.
Data protection
Personal data breaches are handled as described in our Privacy Notice, including notice to the Nigeria Data Protection Commission within 72 hours of our becoming aware where the law requires it. For data-protection questions, write to privacy@gen318.com.
Our machine-readable contact details are published at /.well-known/security.txt.