Valor Path Connect

Security Policy

ValorPathConnect Effective September 26, 2026

Valor Path Corporation serves people who are often at their most vulnerable when they reach us. We treat the security of this application as part of that duty, not as an afterthought. This policy describes how ValorPathConnect is protected and how to report a problem.

1. Security by data minimization

The strongest security control available to us is not collecting sensitive information in the first place. ValorPathConnect is deliberately built with:

  • No user accounts, passwords, or logins — there are no credentials to steal, phish, or reuse.
  • No cookies or server-side sessions — there are no session tokens to hijack.
  • No payment processing on our systems — donation and card data pass directly from your browser to Donorbox and its PCI-compliant processors. Card numbers never touch our infrastructure.
  • No IP addresses in the database, no medical information, no service records, and no benefits data.
  • No advertising networks and no cross-site tracking. Site measurement uses Fathom Analytics, a cookieless, privacy-focused service that collects no personal information and builds no visitor profiles.

A breach of this application would not expose payment information, health information, or account credentials, because the application does not hold them.

2. Transport and browser protections

All traffic is served over HTTPS with TLS. The application sends a full set of hardened security response headers, including:

  • HTTP Strict Transport Security (HSTS), so browsers refuse to connect insecurely;
  • A strict Content Security Policy that permits scripts only from our own origin and one named, audited analytics provider — no inline scripts and no eval — sharply limiting cross-site scripting;
  • frame-ancestors 'none', preventing the site from being embedded in another page for clickjacking;
  • X-Content-Type-Options: nosniff, a restrictive Referrer-Policy, and a Permissions-Policy disabling browser features the application does not use.

The one external frame permitted is the Donorbox donation form, allowed by an explicit, narrowly scoped rule. That frame loads only after you click Donate.

The application's header configuration has been verified against an independent third-party security header scanner, achieving its highest grade.

3. Application protections

  • Parameterized database queries throughout, protecting against SQL injection.
  • Rate limiting on public endpoints, correctly resolving the true client address behind our hosting layer, to blunt abuse, scraping, and denial-of-service pressure.
  • Input validation and output encoding on user-supplied content.
  • Credentials and API keys held as environment secrets, never committed to source code, and rotatable without a code change.
  • Redacted logging on sensitive paths, so crisis-related search text is never written to our operational logs.
  • Automated test coverage exercised on every change, including the crisis-detection and privacy-redaction paths.
  • Dependencies are kept current, with security updates applied as they are released.

4. Administrative access

Administrative dashboards are restricted to authorized Valor Path Corporation personnel, require a configured credential, are excluded from search engine indexing, and are not linked from any public page. Access is limited to the smallest number of people who need it.

5. Infrastructure

ValorPathConnect runs on managed cloud infrastructure with a managed PostgreSQL database. Data is encrypted in transit, and encrypted at rest by our hosting and database providers. We rely on those providers for physical security, network isolation, and platform patching, and we review their security posture as part of choosing them.

6. Reporting a vulnerability

We welcome reports from security researchers and users, and we will not pursue legal action against anyone acting in good faith under this policy.

Email team@valorpath.org with "Security" in the subject line. Please include:

  • What you found and where, with the URL or endpoint;
  • The steps needed to reproduce it;
  • What an attacker could do with it;
  • How you would like to be credited, if you would like credit.

What we ask of you:

  • Give us a reasonable opportunity to fix the issue before disclosing it publicly.
  • Do not access, modify, download, or delete data that is not your own. If you encounter someone else's data, stop and tell us.
  • Do not run denial-of-service tests, send spam, or use social engineering or physical attacks against our staff or providers.
  • Stay within the scope of valorpathconnect.org. Our donation platform, hosting providers, and the organizations listed in results are operated by others and are out of scope.

What we commit to:

  • Acknowledging your report within five business days.
  • Telling you our assessment and our intended fix.
  • Letting you know when it is resolved, and crediting you if you would like.

We are a small nonprofit and do not operate a paid bug bounty program. We are grateful for reports regardless.

7. If something goes wrong

If we determine that personal information has been exposed, we will investigate promptly, take action to contain and remediate it, notify affected individuals and applicable authorities as required by applicable state and federal law, and describe plainly what happened and what we are doing about it.

8. An honest limit

No system connected to the internet is perfectly secure, and we will not claim otherwise. What we can commit to is minimizing what we collect, applying current protections, fixing what is reported to us, and telling the truth about it.

9. Contact

Valor Path Corporation 1040 N Market St, Washington, NC 27889 team@valorpath.org · valorpath.org