Reporting a vulnerability.

What this policy covers

This policy covers this website at 1stcyber.co.uk and the 1ST Cyber client portal. It doesn’t cover:

• our clients’ systems. If you find a vulnerability in one, report it to that organisation;
• services run by our suppliers, such as our hosting provider. Report those to the supplier;
• findings from automated tools that come without a demonstrated security impact.

How to report a vulnerability

Use our contact form to tell us you have a security vulnerability to report, without including the details. We’ll reply with a secure way to send them.

What to include

• the web address or the part of the client portal affected;
• a description of the vulnerability and the steps to reproduce it;
• any proof of concept, such as requests and responses or screenshots;
• the impact you think it could have;
• how we can contact you.

Please don’t include other people’s personal information in your report. Our contact details are also published in security.txt.

When you investigate

Please don’t:

• break the law, or any agreement you have with someone else;
• access, change, copy or delete data that isn’t yours. Use an account of your own for testing, and if you reach someone else’s data by mistake, stop, don’t keep it and tell us;
• run denial-of-service or high-volume automated tests, or anything else that could degrade the service for others;
• use social engineering, phishing or physical attacks against our staff, premises or clients;
• disclose the vulnerability publicly before it has been fixed, or before we’ve agreed a date with you.

What we’ll do

• Acknowledge your report within 5 working days.
• Keep you informed while we investigate and fix the issue.
• Tell you when the vulnerability has been fixed.
• Agree with you when details can be made public.
• Treat your report and contact details as confidential, and use them only to handle the report.

Acting in good faith

If you act in good faith and follow this policy, we won’t take legal action against you or ask the police to investigate you over your research.

This policy doesn’t give you permission to act in a way that breaks the law, or that could put 1ST Cyber, our clients or our suppliers in breach of a legal obligation.

Rewards

We don’t run a paid bug bounty programme.