Vulnerability Disclosure Policy

As a cyber security compliance business, we take the security of our own platform seriously and welcome reports from security researchers who find a genuine issue.

How to report

Email security@cyberseccompliance.co.uk with as much detail as you can provide: the affected page or endpoint, the steps to reproduce, and the potential impact. If a proof-of-concept is helpful, include it - please avoid accessing, modifying or exfiltrating any real customer data beyond what's strictly necessary to demonstrate the issue.

What we ask

• Give us a reasonable opportunity to investigate and fix an issue before disclosing it publicly.
• Don't test against real customer accounts - if you need a test account, ask us for one.
• Don't run automated scanning tools that could degrade service for real customers, and don't attempt denial-of-service testing.
• Act in good faith and avoid privacy violations, data destruction, or service disruption.

What you can expect from us

• An acknowledgement of your report within a reasonable timeframe.
• An honest assessment of the issue's severity and our plan to address it.
• Credit for the finding, if you'd like it, once resolved.
• No legal action against good-faith security research conducted in line with this policy.

Scope

This policy covers our marketing website and customer portal. If you're unsure whether something is in scope, ask - we'd rather field an out-of-scope report than miss a real issue.

Contact

security@cyberseccompliance.co.uk