defensecrypt.

Policy / Responsible disclosure

Found a flaw
in our systems?
Tell us.

We look for vulnerabilities in other people’s systems for a living. We want to hear about any in ours.

Last updated
Report to
contact@defensecrypt.co.uk
01

Scope

This policy covers systems that Defensecrypt operates:

  • defensecrypt.co.uk and its pages
  • The enquiry form and its /api/ endpoints

Out of scope

  • Services we use but do not operate, such as Cloudflare and Google. Please report issues in those to the provider directly.
  • Systems belonging to our clients. Report those to the organisation that owns them.
  • Missing best-practice headers or configuration, unless you can show a real security impact.
02

How to report

Email contact@defensecrypt.co.uk with “Security report” in the subject line. A useful report includes:

  • The affected URL or component
  • A description of the vulnerability and its likely impact
  • Steps to reproduce it, or a minimal proof of concept
  • How you would like to be credited, if at all

Please do not include personal data or other sensitive information beyond what is needed to show the issue.

Our security.txt file lists the same contact details in a machine-readable format.

03

Testing rules

While investigating, please:

  • Access or change only the data needed to show the vulnerability, and stop once you have shown it.
  • Do not keep, share or publish any personal data you come across.
  • Do not run denial-of-service tests or heavy automated scanning that could degrade the website.
  • Do not flood the enquiry form or send it spam. Real enquiries arrive through it.
  • Do not use social engineering, phishing or physical attacks.
  • Give us a reasonable time to fix the issue before you disclose it publicly. We suggest 90 days, and we are happy to agree a date with you.
04

What to expect

When you report a vulnerability, we aim to:

  • Acknowledge your report within five working days
  • Confirm whether we can reproduce the issue, and keep you updated while we work on it
  • Tell you when it has been fixed
  • Agree a disclosure date with you if you plan to publish
05

Safe harbour

If you make a good-faith effort to follow this policy, we will treat your research as authorised. We will not take or support legal action against you for it. If a third party takes legal action against you for activity that followed this policy, we will make it known that your research was authorised.

If you are unsure whether something you plan to do is allowed, ask us first.

06

Recognition

We do not run a paid bug bounty. With your permission, we are glad to credit you publicly for a valid report once it has been fixed.