Responsible Disclosure Policy

If you have found a security problem in this site or in something we built, please tell us. This page explains how, and what we will do about it.

1. How to report

Email the details to the address at the bottom of this page. Include what you found, the steps to reproduce it, and what an attacker could do with it. A short proof of concept helps more than a scanner report.

2. What we will do

• Acknowledge your report within 2 business days.
• Tell you whether we can reproduce it within 7 days.
• Keep you updated while we fix it, and tell you when it is fixed.
• Credit you publicly if you would like that, or keep you anonymous if not.

3. What we ask of you

• Give us reasonable time to fix it before telling anyone else.
• Do not access, change or delete data that is not yours. If you come across someone else's data, stop and tell us.
• No denial of service, no spam, no social engineering of our staff or clients, and no physical attacks.
• Test only against this site — not against systems we built for clients. Those belong to the client, and we cannot authorise testing on them.

4. Our commitment

We will not pursue legal action against anyone who follows this policy in good faith. If a report leads us to believe you have gone beyond it, we will tell you why before doing anything else.

5. Rewards

We do not run a paid bug bounty. We do offer public credit and, for a serious finding, a genuine reference.