Responsible Disclosure

We run a cybersecurity consultancy, so it would be poor form to make reporting an issue to us difficult. If you believe you have found a vulnerability in this website, please tell us before disclosing it publicly, and we will work with you to resolve it.

How to report

Use the contact details published on this website, with the subject line “Security report”. Please include enough detail for us to reproduce the issue: the affected URL, the steps you took, and what you observed.

What is in scope

• This website and its public endpoints.
• Issues affecting the confidentiality or integrity of information submitted through the contact form.
• Misconfiguration of security headers, TLS, or access controls on this domain.

What is out of scope

• Findings from automated scanners without a demonstrated impact.
• Missing best-practice headers with no exploitable consequence.
• Social engineering of our staff, clients or service providers.
• Denial of service, volumetric testing, or anything that degrades availability for others.
• Systems belonging to our clients or third parties — those are not ours to authorize.

Please do not

• Access, modify or delete data that is not your own.
• Run automated testing at a volume that affects site availability.
• Disclose the issue publicly before we have had a reasonable opportunity to remediate it.

What to expect

We aim to acknowledge reports promptly, keep you informed while we investigate, and tell you when the issue is resolved. We do not currently operate a paid bug bounty. We are glad to credit reporters who would like acknowledgement.

If you act in good faith, stay within the scope above, and avoid privacy violations and service disruption, we will not pursue action against you for your research.