A safe initial report
Describe the affected URL or component, the observed behaviour and potential impact without sending secrets or unnecessary personal data.
Security Statement
Start a responsible security conversation and confirm deployment-specific assurance.
Draft for review: this explanatory content requires approval against verified practices and applicable legal requirements.
Security discussions
Request current evidence and a responsibility matrix for your intended deployment. General website descriptions are not a certification or contractual control commitment.
Reporting a concern
Send a concise initial report to [email protected]. Do not include secrets, unnecessary personal data or perform testing without explicit written authorisation.
A fresh perspective
Responsible reporting is a conversation, not permission to test.
This explanatory draft describes how to start a security discussion and the responsibilities to confirm for a proposed service.
Practical insights
Make your next step more informed
Authorised assessment boundaries
Obtain explicit written permission before testing systems, accessing records or performing activity that could affect availability.
Deployment-specific assurance
Ask for applicable documentation covering access controls, hosting, recovery and shared responsibilities for the intended deployment.
FAQ
Helpful answers before your next step
How can I start a security report?
Email [email protected] with a concise description and the affected component. Do not include passwords, private keys or bulk personal records.
May I test systems after reading this page?
No. Any testing requires explicit written authorisation covering targets, methods and timing. Public accessibility is not permission.
Can we request security evidence before purchasing?
Yes. Explain your requirements and intended deployment. The team can confirm the documents available and any confidentiality process.
Is this a bug bounty or safe-harbour programme?
No such programme is established by this draft statement. Any separate programme would need explicit, published terms.