Security Policy

Translation notice

1. Principles

As a development company that handles clients’ services and data, the Company follows these principles.

• Least privilege: we request only the access needed for the project, and ask for rights to be revoked or passwords changed when the work is done.
• Separation: client data is separated from development and demo environments, and work is done in isolated workspaces per project.
• Transparency: when we become aware of a security incident we do not hide it; we report the scope of impact and the measures taken immediately.

2. Site operations security

• Encryption in transit: HTTPS (TLS) across the whole site; requests over http or www are redirected to the canonical address (https://damong.co.kr).
• Access control: the admin interface and internal APIs require login session authentication and are excluded from search engine indexing.
• Automatic attack blocking: requests to known vulnerability-scanning paths (other CMS admin paths, etc.) are blocked automatically, and repeated abnormal access is managed as a blocking target.
• Access logging: access time, IP and visited paths are recorded and automated access is detected to identify abuse.
• Uploaded files: uploaded files are stored under transformed names so the original file name is not exposed, and the upload path is excluded from search engine indexing.
• Secrets: external API keys and system integration tokens are injected through environment variables.

3. Development and delivery security

• Work isolation: development is performed in workspaces separated per project and task so that work does not affect other work.
• Internal network protection: there is no path for direct access from outside into the internal development environment; internal systems integrate by sending outbound requests only.
• System-to-system authentication: communication between development automation systems is authenticated with dedicated tokens.
• Request target restriction: addresses relayed by the internal proxy are restricted to private and loopback ranges to prevent server-side request forgery (SSRF).
• Session separation: administrator session cookies are not forwarded to client sites under construction, and the scope of response cookies is narrowed to that site’s path.
• Protection of drafts: drafts are private by default before approval and excluded from search engine indexing so they are not exposed before the client’s launch schedule.

4. Handling of client materials

• Materials received through inquiries and briefs are used only to review and propose on that matter and are not disclosed to third parties.
• Account and access credentials received from clients are kept only for the period needed for the work, and are destroyed or we request they be changed after completion.
• The items of personal data collected and their retention periods do not exceed what is set out in the Privacy Policy.

5. Reporting vulnerabilities

If you find a security vulnerability on the Site or in a deliverable produced by the Company, please let us know at damong@damong.co.kr. After confirmation we reply with the remediation plan and result.

• Including reproduction steps and the scope of impact in your report speeds up remediation.
• Please do not access, modify or exfiltrate data beyond the minimum needed to confirm the vulnerability, and do not harm service availability (e.g., by causing overload).
• The Company takes no legal action against reporters who act in good faith within these limits.

6. Incident response

1. When a security incident is recognized, the attack path is blocked immediately and the scope of impact is confirmed.
2. On becoming aware of a leak of personal data, the Company notifies data subjects within 72 hours of the items, time, circumstances and response measures in accordance with Article 34 of the Personal Information Protection Act, and reports to the Personal Information Protection Commission or KISA where the statutory requirements apply.
3. After remediation, the cause is analyzed, recurrence-prevention measures are established, and results are shared with affected clients.

7. Scope and revision

This Security Policy applies to damong.co.kr operated by the Company and to the development and operations work the Company performs. Changes are reflected on this page together with the effective date.

Effective: October 14, 2026

Business information