Reporting a Security Issue

Please send security reports privately to:

[SECURITY EMAIL]

Please include, where reasonably possible:

• the affected product and version;
• a description of the suspected vulnerability;
• steps required to reproduce it;
• the potential security impact;
• proof-of-concept information necessary to understand the issue;
• any suggested remediation, if available.

Please Do Not

When performing security research relating to our systems, please do not:

• access or modify another person’s data;
• attempt to obtain passwords or authentication credentials belonging to other users;
• perform denial-of-service or resource-exhaustion attacks;
• use social engineering or phishing;
• install malware;
• damage or destroy data;
• disrupt production services;
• publish an unresolved vulnerability before reasonable remediation and disclosure coordination.

Scope

This policy applies to security issues in software and internet systems directly controlled by [LEGAL BUSINESS NAME].

Vulnerabilities solely affecting unrelated third-party services should normally be reported to the responsible third party.

Sensitive Information

Do not include real customer passwords, payment-card details, private API credentials or unnecessary personal information in a vulnerability report.

Our Response

We will review credible security reports, investigate reproducible issues and determine appropriate remediation based on severity, affected versions and technical circumstances.

We may request additional technical information where necessary to reproduce or understand a report.

No Bug-Bounty Promise

Unless a separate bug-bounty programme is expressly announced, submission of a vulnerability report does not create an entitlement to payment, compensation or reward.