Security at Moned.

Moned uses authenticated BFF sessions, CSRF protection, role-scoped authorization, step-up controls for sensitive admin actions, append-only decision receipts, private object storage patterns, and rate limiting where implemented.

Sensitive uploads remain quarantined until validation and configured malware scanning succeed. If a general-purpose scanner is unavailable, support evidence remains disabled rather than being accepted without protection.

Use the security disclosure form or email security@moned.ai. Do not include credentials or unnecessary personal data, disrupt service, access data that is not yours, or publish before coordination.

Moned does not publish response-time guarantees, certifications, bounty promises, or safe-harbor commitments unless they are operationally and legally approved.