Security & Infrastructure Framework

Platform Architecture & Security

How Continuous isolates tenant applications, enforces cryptographic security, and maintains ecosystem integrity.

1. Public Suffix List (PSL) Isolation

Continuous utilizes cntnus.app as the base domain for multi-tenant incubator ventures. To protect users and tenants from cross-site vulnerabilities, cntnus.app is submitted to the Mozilla-maintained Public Suffix List (PSL) under the PRIVATE section.

PSL inclusion guarantees that modern browsers treat each subdomain (such as tenant-a.cntnus.app and tenant-b.cntnus.app) as distinct effective top-level domains (eTLD+1), providing:

Supercookie Prevention: Subdomains cannot set cookies accessible by sibling applications or the apex domain.
SameSite Boundary Enforcement: Cookie SameSite attributes treat sibling subdomains as cross-site origins.
Client Storage Partitioning: LocalStorage, IndexedDB, Service Workers, and Cache APIs remain strictly isolated between tenants.

// Mozilla Public Suffix List (PSL) Entry
// Continuous : https://cntn.us
// Submitted by Continuous <admin@cntn.us>
cntnus.app
        

2. Strict Transport Security (HSTS)

The .app top-level domain is managed by Google Registry and is preloaded on the global Chrome/Firefox/Safari/Edge HSTS Preload List at the root TLD level.

All requests to cntnus.app and all existing or future subdomains automatically require TLS/HTTPS. Cleartext HTTP connections are never established, protecting against man-in-the-middle (MITM) and protocol downgrade attacks.

3. DNS & Certificate Authority Authorization (CAA)

To prevent unauthorized certificate issuance, authoritative CAA records are deployed across all Continuous infrastructure, strictly restricting certificate issuance to authorized CAs:

cntnus.app.  IN  CAA  0 issue "amazon.com"
cntnus.app.  IN  CAA  0 issue "letsencrypt.org"
cntnus.app.  IN  CAA  0 issuewild "amazon.com"
cntnus.app.  IN  CAA  0 issuewild "letsencrypt.org"
cntnus.app.  IN  CAA  0 iodef "mailto:admin@cntn.us"
        

4. Email Authentication (DMARC, SPF, DKIM)

To prevent brand impersonation and spoofing across our incubator subdomains, strict DMARC policies are enforced at the apex level:

_dmarc.cntnus.app.  IN  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:admin@cntn.us; pct=100"
cntnus.app.         IN  TXT  "v=spf1 -all"
        

5. Vulnerability Disclosure

Security researchers who discover potential vulnerabilities in Continuous infrastructure or tenant platforms are invited to report them responsibly to admin@cntn.us.