Security at Astralune.
X.H. Noctuer Holdings Pty Ltd · trading as Astralune
Prepared
Accountable security lead
Astralune is the business operated by X.H. Noctuer Holdings Pty Ltd. Our work includes deploying and maintaining AI systems, websites and business software. Security responsibilities sit alongside that engineering and operational work. Yixuan (Asher) Zhang, Founder and Security Lead, is the accountable contact for the Product and Infrastructure Security function. He reviews the scope of security work, approves access to security tools and coordinates responses to reported issues. He can be reached at asher@astralune.ai.
Security function
The function covers the company's own software and infrastructure, together with client systems for which the company has an explicit mandate. Its remit includes secure code review, configuration assessment, vulnerability triage, remediation and verification of fixes. Client engagements must identify the assets concerned and the activities that the owner permits. A relationship to a client, possession of credentials or access to a system does not by itself establish permission to perform adversarial testing.
Workspace membership
The company is preparing a security workspace with planned capacity for ten named users as the team expands. Membership is assigned to people who perform or directly supervise the approved work. Each person must receive individual approval and meet the applicable account and device requirements before using restricted capabilities. The planned capacity describes the intended expansion; access remains tied to the approved membership and the work assigned to each member.
Authorised testing
Before active testing begins, the system owner and security lead must approve a written scope, permitted methods, exclusions and testing window. Work must stop if it reaches an unapproved asset or creates unexpected service impact. Reports go to the system owner through the agreed channel. Credentials, personal information and client material must be limited to what the authorised task requires and handled under the engagement's data instructions.
Access and reporting
Access to a security tool or verification programme is separate from permission to test a client's system. Any client-facing product that exposes restricted model capabilities also requires the provider's applicable product authorisation. Security enquiries and vulnerability reports should be sent to the named security lead with a concise description of the affected asset and the observed issue. Please arrange a secure transfer before sending credentials or sensitive evidence.
