Security & Infrastructure Framework

Platform Architecture & Security

How Continuous isolates tenant applications, enforces cryptographic security, and maintains ecosystem integrity.

1. Strict Transport Security (HSTS)

The .app top-level domain is managed by Google Registry and is preloaded on the global Chrome/Firefox/Safari/Edge HSTS Preload List at the root TLD level.

All requests to cntnus.app and all existing or future subdomains automatically require TLS/HTTPS. Cleartext HTTP connections are never established, protecting against man-in-the-middle (MITM) and protocol downgrade attacks.

2. DNS & Certificate Authority Authorization (CAA)

To prevent unauthorized certificate issuance, authoritative CAA records are deployed across all Continuous infrastructure, strictly restricting certificate issuance to authorized CAs:

cntnus.app.  IN  CAA  0 issue "amazon.com"
cntnus.app.  IN  CAA  0 issue "letsencrypt.org"
cntnus.app.  IN  CAA  0 issuewild "amazon.com"
cntnus.app.  IN  CAA  0 issuewild "letsencrypt.org"
cntnus.app.  IN  CAA  0 iodef "mailto:admin@cntn.us"
        

3. Email Authentication (DMARC, SPF, DKIM)

To prevent brand impersonation and spoofing across our incubator subdomains, strict DMARC policies are enforced at the apex level:

_dmarc.cntnus.app.  IN  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:admin@cntn.us; pct=100"
cntnus.app.         IN  TXT  "v=spf1 -all"
        

4. Vulnerability Disclosure

Security researchers who discover potential vulnerabilities in Continuous infrastructure or tenant platforms are invited to report them responsibly to admin@cntn.us.