AP DSC SCAM — PUBLIC SECURITY & INCIDENT-RESPONSE NOTE
Version 5.5 · 4 September 2026

Security reporting: helpdesk@apdscscam.com
Machine-readable contact: /.well-known/security.txt
Service health: /api/health

Controls in this release
- HTTPS/HSTS and restrictive response headers.
- Per-response cryptographic nonces for executable inline scripts.
- Same-origin, size-limited, server-validated contact requests.
- Durable 15-minute abuse-rate buckets storing only a one-window hash, never a raw IP address.
- Honeypot and minimum-completion-time bot controls.
- Authenticated HTTPS delivery to the official inbox through a server-side email API; the API key is never exposed to browsers.
- No front-end secrets and no file-upload endpoint.
- SHA-256 publication manifest and versioned correction log.

Incident sequence
1. Suspend the affected intake or publication path.
2. Preserve relevant logs, versions and evidence without altering source records.
3. Determine the affected data, people, time window and root cause.
4. Notify the publication owner and legal/privacy reviewer.
5. Notify affected people and authorities where law or risk requires it.
6. Remediate, verify, restore and publish a correction or security notice.

Operational requirement
The domain owner should maintain availability monitoring, dependency alerts and an authorised incident-response contact for the public website.