Portal security and legitimacy policy

Platform purpose

The domains identified on this page are part of a private platform used to manage:

• Procurement and bidding processes.
• Supplier registration and administration.
• Receipt of bids and corporate documentation.
• Evaluation and monitoring of purchasing processes.
• Access by previously registered and authorized users.

Access to certain areas of the portal may require authentication using previously assigned credentials.

Security controls and practices

MIR Imagen maintains technical and administrative controls intended to protect the platform and the information it processes.

• Encrypted HTTPS connections and valid digital certificates.
• Perimeter protection and traffic filtering through Cloudflare.
• Authentication-based access restrictions for private modules.
• Review of files, PHP code, JavaScript, and server configurations.
• Periodic application of security updates and corrections.
• Monitoring of redirects, domains, certificates, and DNS configurations.
• Investigation of alerts reported by security vendors and reputation engines.

Responsible vulnerability reporting

If you discover a possible vulnerability or suspicious behavior related to these domains, please report it responsibly.

Information to include in the report

1. The exact URL or module where the issue was identified.
2. A clear description of the observed behavior.
3. Approximate date and time of detection.
4. Steps required to reproduce the issue.
5. Screenshots or technical evidence, when possible.
6. Contact information so that additional details may be requested.

Information that should not be sent

• User passwords.
• Authentication tokens.
• Cookies or session identifiers.
• Confidential supplier information.
• Complete databases.
• Personal documents that are not necessary.

Guidelines for security researchers

Researchers are requested to act in good faith and limit testing to what is strictly necessary to document a potential vulnerability.

• Do not interrupt service availability.
• Do not perform denial-of-service attacks.
• Do not modify, delete, or disclose information.
• Do not access accounts or documents belonging to other users.
• Do not use social engineering against users or employees.
• Do not install malware or execute destructive code.
• Allow a reasonable period to investigate and correct the finding before public disclosure.

security.txt file

Official technical information for vulnerability reporting is also published in the standard security.txt file.

Communication verification

Before providing credentials, documents, or sensitive information, users should confirm that they are visiting one of the official domains identified on this page.

MIR Imagen will not request passwords through unauthorized messages or ask users to enter their credentials on domains other than those officially declared.

Any website, email, or message using a similar name but directing users to a different domain should be reported to the security contact.

Updates to this information

This page may be updated when domains, contact information, security controls, or technology migration conditions change.

Last updated: July 18, 2026.