We are a security company, so we expect our own site to be held to a high standard. This page describes what we do and how to tell us if you find a problem.
How we protect this site
- Encryption in transit on every page and strict browser security headers, including a content security policy that stops the site loading code from other places.
- The site loads no third-party scripts, fonts or trackers.
- Forms are checked in the browser, again on the server and a third time by the database, and the database accepts public submissions through one narrow function only.
- Rate limits and automatic blocking of floods and scanners.
- Staff areas protected by individual accounts, row-level access rules and an audit trail that cannot be edited.
- Updates, backups and monitoring as part of how we run the platform.
Report a weakness
If you believe you have found a security weakness on this website, email [email protected] with the details and steps to reproduce it. A machine-readable version of this policy is at /.well-known/security.txt.
- Give us reasonable time to fix the problem before you tell anyone else.
- Do not access, change or delete data that is not yours, and stop as soon as you have shown that the weakness exists.
- Do not use denial of service, social engineering, spam or physical attacks.
- Only test this website. Other companies' systems, including our clients' and our sister company's, are out of scope.
Our commitment
If you follow these rules and act in good faith, we will not take legal action against you for your research, and we will thank you if you wish. We cannot offer a payment for reports. This statement does not authorise any activity that breaks the law, including the Computer Misuse and Cybercrimes Act, 2018.