Auth and RBAC
Protected routes, role classes, session strategy, least-privilege defaults, and admin surfaces that separate operator, staff, and read-only actions.
Security and reliability
Security is designed into the workflow, not added after launch.
Grayston builds with authentication, authorization, validation, logs, deployment discipline, and operational handoff in mind from the first architecture pass.
Report an issue
Security concerns for this website can be sent to jforster@graystontechnologies.com. Do not include passwords, tokens, or sensitive third-party data.
Delivery controls
Practical controls for production software.
Controls are tailored to each engagement. The baseline is a clear auth model, minimal secrets exposure, deployment separation, validated data movement, and evidence that operators can use.
Validation and auditability
Input validation, workflow state checks, event logs, export-ready records, and evidence views for systems that need defensible operational history.
Environment discipline
Separate environments, secret hygiene, preview deployments, release gates, rollback paths, and configuration that keeps production changes intentional.
Reliable integrations
Idempotent webhooks, rate limiting where appropriate, structured errors, retry posture, replay protection, and integration contracts that can be operated.
Logs and triage
Structured logs, uptime checks, release notes, runbooks, and practical incident triage so launch does not become the end of accountability.
Human-reviewed AI use
AI accelerates implementation, documentation, refactoring, and testing, but production changes still go through human review and verification.
Responsible disclosure
Security reports should be useful, controlled, and non-destructive.
If you believe you found a vulnerability in this website or a Grayston-operated product, email a concise report with the affected URL, reproduction steps, browser/device context, screenshots if helpful, and potential impact.
Do not access, change, delete, download, or exfiltrate data that is not yours. Do not run destructive tests, denial-of-service tests, social engineering, or credential attacks. Grayston does not currently operate a paid bug bounty program.
Report Security Concern