Responsible disclosure

How to report

Email security@protegosol.com with a clear description, affected URL or system, steps to reproduce, impact, and any supporting request or response details. Do not include unnecessary personal data. Encrypt sensitive reports using our published key when one is listed in security.txt.

Scope

This policy covers internet-facing systems and websites owned and operated by Protego Sol Limited, including protegosol.com and subdomains expressly identified in security.txt. Third-party services, client systems, denial-of-service testing, social engineering, physical testing and attempts to access another person's data are out of scope unless we give written permission.

Safe harbour

If you act in good faith, comply with this policy, avoid privacy violations and service disruption, and report promptly, Protego will not initiate legal action against you for the research. If a third party initiates action and your research complied with this policy, we will make that compliance known. This statement does not authorise activity prohibited by law or bind third parties.

Research rules

• +Use the minimum testing needed to demonstrate the issue.
• +Stop if you encounter personal data, credentials, client information or evidence of active compromise, and report it immediately.
• +Do not download, retain, alter or disclose data that is not yours.
• +Do not use automated testing that could degrade availability, and do not send spam or conduct social engineering.
• +Do not publish the issue before we have confirmed remediation or agreed a disclosure date.

What to expect

We aim to acknowledge a report within two business days, provide an initial assessment within five business days, and send progress updates at least every ten business days while remediation is active. Resolution time depends on severity and dependencies. We will credit a researcher who requests it, unless legal or client obligations prevent attribution. We do not currently operate a paid bug bounty.