[ Legal ]

Responsible disclosure

We protect other organisations' systems, so we take reports about our own seriously. If you have found a vulnerability, we want to hear about it.

Last updated

How to report

Email hello@cyfenced.com with "Security" in the subject. Include:

  • the affected system or URL;
  • a description of the vulnerability and its impact;
  • the steps to reproduce it, with proof-of-concept code or screenshots where helpful;
  • how we can reach you.

Our machine-readable contact details are in security.txt.

Scope

In scope: www.cyfenced.com and the subdomains of cyfenced.com that we operate, including Guardian. Out of scope: third-party services we use, such as our hosting and email providers. Please report issues in those directly to the vendor.

What we ask of you

  • Do only what is needed to demonstrate the vulnerability. Do not access, change or delete data that is not yours.
  • Do not run denial-of-service tests, spam, social engineering or physical attacks.
  • Do not share the vulnerability with others until we have fixed it.
  • Do not use the vulnerability beyond confirming it, for example by installing a backdoor or moving to other systems.

What we do in return

  • We confirm receipt of your report within three working days.
  • We keep you informed while we investigate and fix the issue.
  • If you have followed these rules, we will not take legal action against you for the report.
  • With your permission, we credit you once the issue is fixed.

We do not run a paid bug bounty programme.