Security & Compliance

Semantic HTML & Structure

• Semantic HTML5 elements (header, nav, main, section, article, footer)
• Proper heading hierarchy (h1 → h2 → h3, no skipping levels)
• Logical reading order and document structure

Navigation & Keyboard Access

• Skip to main content link for screen reader users
• Full keyboard navigation support
• Visible focus indicators (2px solid outline)
• ARIA labels and roles for interactive elements
• Mobile menu with proper accessibility attributes

Visual & Content Accessibility

• Descriptive alt text for all images
• Color contrast ratio ≥ 4.5:1 (WCAG 2.1 AA compliant)
• No reliance on color alone for information
• Responsive design for various screen sizes
• Support for screen readers

Technical Accessibility

• Proper lang attribute on HTML element
• Form labels and error messages
• Reduced motion support (prefers-reduced-motion media query)
• Semantic markup for assistive technologies

TDL-001: Clickjacking Protection

Severity: Low | Status: Remediated

Issue: Website was vulnerable to clickjacking attacks where malicious sites could embed our pages in invisible iframes.

Remediation: Implemented X-Frame-Options header with "DENY" directive and Content Security Policy (CSP) frame-ancestors directive to prevent unauthorized embedding.

Implementation: Security headers are configured at the web server level to prevent iframe embedding from external domains.

TDL-002: Security Headers

Severity: Low | Status: Remediated

Issue: Missing essential HTTP security headers that protect against XSS, clickjacking, and MIME-type sniffing.

Remediation: Implemented comprehensive security headers:

• Content-Security-Policy (CSP): Prevents XSS and data injection attacks
• X-Frame-Options: DENY - Prevents clickjacking
• X-Content-Type-Options: nosniff - Stops MIME-type sniffing
• Referrer-Policy: no-referrer-when-downgrade - Controls referrer information
• Strict-Transport-Security (HSTS): Enforces HTTPS connections
• Permissions-Policy: Restricts use of powerful browser features

TDL-003: Vulnerable & Outdated Components

Severity: Low | Status: Remediated

Issue: Use of outdated third-party JavaScript libraries (jQuery) with known vulnerabilities.

Remediation: Removed dependency on third-party JavaScript libraries. The website now uses only vanilla JavaScript (ES6+) with no external dependencies, eliminating security risks from outdated components.

Implementation: All functionality has been reimplemented using modern, secure vanilla JavaScript without external library dependencies.

TDL-004: Server Name and Version Disclosure

Severity: Low | Status: Remediated

Issue: Server headers exposed software names and versions, aiding attackers in fingerprinting.

Remediation: Configured web server to suppress server details in HTTP headers and error messages. Server information is no longer disclosed in response headers.

Regular Security Audits

Xponentia conducts regular security assessments including:

• Annual VAPT (Vulnerability Assessment and Penetration Testing)
• Quarterly security reviews
• Continuous monitoring of security advisories
• Dependency scanning for vulnerabilities

Accessibility Audits

In compliance with SEBI Circular requirements:

• Accessibility audits conducted by IAAP-certified professionals
• Usability testing involving persons with disabilities
• Annual accessibility compliance reporting
• Regular updates to maintain WCAG 2.1 AA compliance

Training & Awareness

Xponentia ensures that:

• All staff and third-party service providers receive training on digital accessibility
• Content developers are aware of WCAG 2.1 requirements
• Security best practices are followed in all digital initiatives