Report a security concern safely.

This policy provides a reporting route. It does not authorise scanning, exploitation, password attacks, access-control bypasses, intrusive testing or access to information you are not entitled to view.

If you want permission for security testing, contact us first and wait for express written authorisation covering the systems, methods and boundaries. A report, an automated acknowledgement or silence does not grant that permission.

Email [email protected] with the subject Security vulnerability report. Include, where available:

• The affected URL or public function.
• What you observed and when, including your time zone.
• The steps that led to the observation, without repeating harmful activity.
• The potential impact and any limits to what you have established.
• Minimal, redacted screenshots or other evidence needed to understand the issue.
• A contact route for follow-up, if you want us to reply.

You do not need to demonstrate the maximum possible impact. Do not attach passwords, private keys, access tokens, full customer records, malware or large data extracts. If validation requires sensitive material, describe it first and ask us how to share it appropriately.

Stop further access or testing. Do not browse additional records, download data, change information, establish persistence or share the material with others. Report what happened and avoid reproducing sensitive details in ordinary email.

Tell us if you have already retained a copy so we can discuss appropriate handling. Preserve only what is lawfully necessary, and follow an agreed secure deletion or preservation approach. Do not destroy evidence that you are legally required to preserve.

Denial-of-service activity, social engineering, physical intrusion, extortion and disruption of services are outside this policy.

We review reports to understand the affected system, likely impact and appropriate next action. Where you provide a reply address, we may ask for clarification and coordinate further information or disclosure with you. Remediation depends on the issue and the systems involved; we do not promise a fixed resolution time.

If you have not received a reply, follow up in the same email thread. This channel is not a continuously monitored emergency service and does not initiate incident response work for another organisation. Existing clients should use the escalation route agreed for their engagement.

We welcome good-faith reports and will not threaten or pursue legal action solely because you reported a concern to us. This commitment does not authorise testing, excuse harmful conduct or bind another organisation or a public authority.

If you are uncertain about an action, ask before taking it. We cannot grant permission over systems or information controlled by someone else.

Please give us a reasonable opportunity to investigate and discuss when and how information can be disclosed safely. Avoid publishing sensitive data or details that unnecessarily increase exposure while the issue is being addressed.

If coordination is not progressing, you may seek assistance from an appropriate vulnerability coordinator, such as CERT-In. Nothing in this policy restricts legally protected disclosures or reporting to a regulator, law enforcement or another competent authority.

Any public acknowledgement of your contribution will be discussed with you first. Reporting does not create an entitlement to payment. No bug-bounty reward is offered under this policy unless we separately agree one in writing.

Information in a report is used to assess the concern, coordinate remediation, protect affected systems and meet applicable legal obligations. We may need to involve the relevant infrastructure or service provider. See our Privacy Notice for information about handling and your available choices.

For questions about the security arrangements relevant to a proposed Subdux engagement, email [email protected]. We can discuss the intended scope and what information can appropriately be provided. This reporting policy is not an assurance report, certification or service-level commitment.