To maintain the security and performance of the Unqork platform, Unqork supports client-initiated Penetration (Pen) Testing. Clients are responsible for engaging with a security firm to conduct the pen test and providing Unqork with the following information to ensure testing traffic is not blocked by infrastructure controls. While Unqork conducts penetration tests on the Unqork Platform, clients might perform additional tests to validate the application logic and configurations unique to their implementation.
Platform Security and the Trust Center
Before scheduling an assessment, review the Unqork Trust Center. This repository contains the latest compliance documentation (SOC2, ISO, and so on), security documentation, and summaries of platform-level testing.
Unqork operates on a shared-security architecture. When a vulnerability is identified, whether through internal red-teaming or a client-led assessment, remediations are evaluated for platform-wide use. Doing so ensures that a security enhancement triggered by one test hardens the environment for all Creators across the ecosystem.
Shared Responsibility Model
Security is a collaborative effort between Unqork and clients:
Unqork’s Responsibility: The security of the platform, which includes the core binary, infrastructure orchestration, network-layer protections, and the physical security of Unqork's Cloud Service Providers (CSPs).
Client’s Responsibility: The security of the application, which including the secure configuration of role-based access control (RBAC), validation of data in modules, and the security of third-party API integrations.
Step 1: Submitting a Pen Test Request
All testing requests must be communicated through Unqork Support to ensure Unqork's Security Operations and DevOps teams can update allow lists for this engagement and distinguish testing traffic from potential threats.
Required Technical Specifications
Navigate to https://support.unqork.com/ and select Submit a Request.
From the Request Type drop-down, select Issue.
From the Issue Type drop-down, select Environment Management.
From the Topic drop-down, select Other.
In the Description field, include the following:
Testing Scope: A high-level overview of the pen test scope for Unqork awareness.
Target Environment(s): The specific FQDNs/URLs in scope.
Testing Start Window: The exact date and time when the pen test is scheduled to begin, including the time zone.
Testing End Window: The exact date and time when the pen test is scheduled to end, including the time zone.
Traffic Signatures: Public source IPs, specific User-Agent strings, or custom header tokens to identify authorized test traffic.
Emergency Point of Contact: A technical lead capable of immediate disengagement if the test impacts platform stability.
Limit penetration testing to Express View applications. Do not test the Designer Platform, which contains inherently privileged functionality. Use non-administrator Express users. Unqork is not responsible for any data integrity issues that might arise from this activity.
The following subdomains are out of scope for client penetration testing:
polyfill.unqork.io(Unqork's browser compatibility service)ex*.unqork.io(Express View environment subdomains; contact Unqork Support to confirm the full scope)
The following activities are restricted:
Attacking common services (like cloud core services)
Denial of service attacks
Unqork reserves the right to block the assessment at any time if it poses a risk to the platform.
Step 2: Unqork Internal Changes
On receipt of the ticket with its required technical specifications, Unqork coordinates internally to ensure penetration test traffic is not blocked. Allow 10 business days of advance notice to ensure Unqork can make any required changes.
Step 3: Collaborative Remediation
While sharing the final report is not mandatory, clients can share relevant findings that might require Unqork Platform remediation with the Unqork Security team using the original support ticket.
Expert Guidance: Sharing results lets Unqork work directly with the client team to ensure vulnerabilities or configuration changes are addressed using best practices.
Validation: Resolve findings according to internal requirements and refer to Security Configuration Best Practices for guidance.
Remediation Testing: Incorporating a retest phase into the software development life cycle (SDLC) ensures that security patches do not introduce regressions or negative side effects.