Responsible disclosure

Our approach

We value the work of security researchers. If you believe you have found a vulnerability in our systems, please let us know so we can fix it.

How to report

Send your report to [to confirm]. Please include:

• a description of the vulnerability and its possible impact;
• the affected URL, component or feature;
• the steps to reproduce it, with screenshots or a proof of concept where useful;
• how we can contact you.

Our security.txt lists the same contact details in a machine-readable form.

Scope

• This website.
• The ILSERIS platform.

Services of third parties are out of scope; please report those to the provider concerned.

What we ask of you

• Do not access, change or delete data that is not yours. Use your own test data or stop as soon as you see data of others.
• Do not disrupt or degrade our services: no denial-of-service tests, no spam and no high-volume automated scanning.
• Do not use social engineering, phishing or physical attacks against our staff, customers or premises.
• Do only what is needed to demonstrate the vulnerability, and do not install backdoors or keep access.
• Keep the vulnerability confidential until we have fixed it or agreed with you on disclosure.
• Delete any data you obtained once you have reported it.

What you can expect from us

• We confirm that we received your report.
• We assess it and keep you informed of our progress.
• We let you know when the issue is resolved.
• We treat your report and your details confidentially.

Safe harbour

If you act in good faith and follow this policy, we will not take legal action against you for your research and will not report you to the authorities for it.

No bounty

We do not run a bug bounty programme and do not offer financial rewards for reports.