Skip to main content

Enterprise cybersecurity, cloud security and compliance

Request Assessment

Legal

Security Disclosure Policy

Last updated:

We welcome reports from security researchers. If you believe you have found a vulnerability in a ThreatGaurd system, please tell us so we can fix it quickly and responsibly.

At a glance

  • Report privatelyEmail us the details, and do not share them publicly before a fix.
  • Test with careUse the minimum testing needed and never access or change data.
  • Clients are off limitsNever test systems that belong to our clients or partners.
  • Good faith protectedWe will not take legal action over research that follows this policy.

Found a vulnerability?

Send us the details by email. Please read the testing rules below before you report.

Report a vulnerability contact@threatgaurd.com

1.Our commitment

Protecting our clients starts with protecting our own systems. We appreciate the work of security researchers and will work with you to understand, verify and fix any genuine issue you report.

2.Scope

This policy covers systems that ThreatGaurd owns and operates.

In scope

  • The threatgaurd.com website
  • Subdomains of threatgaurd.com operated by ThreatGaurd
  • Other systems that ThreatGaurd owns and operates

Out of scope

  • Systems belonging to our clients or partners
  • Third-party services and platforms we use
  • Social engineering or phishing of our people
  • Physical security and denial of service testing

If you find a vulnerability in a third-party product or service, please report it to that vendor.

3.How to report

Email contact@threatgaurd.com with the subject “Security vulnerability report”. Please include:

  • A clear description of the vulnerability and where it is.
  • Step-by-step instructions to reproduce it.
  • The potential impact, as you understand it.
  • Any proof of concept, screenshots or logs that help us verify it.
  • How you would like to be credited, if at all.

Do not include personal data or other sensitive information you may have come across. If you need a secure way to share details, say so in your first email.

4.Testing rules

When researching vulnerabilities, please:

  • Use only the testing needed to confirm a vulnerability, and stop as soon as you have.
  • Do not access, change or delete data that does not belong to you. If you reach such data by accident, stop and tell us.
  • Do not run denial of service tests, or automated scans that could slow down or disrupt our systems.
  • Do not use social engineering, phishing or physical methods.
  • Do not test any system outside the scope of this policy.
  • Keep the details confidential until we have fixed the issue or agreed a disclosure date with you.

5.What you can expect from us

  • We will acknowledge your report and keep you informed as we investigate.
  • We will tell you when the issue has been fixed.
  • With your permission, we will thank you publicly for a valid report.
  • We will treat your report and your details confidentially.

We do not currently run a paid bug bounty programme.

6.Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised, we will not take legal action against you for it, and we will work with you to understand and resolve the issue. If you are unsure whether something is allowed, ask us before you test.

7.Coordinated disclosure

Please give us reasonable time to investigate and fix an issue before sharing it with anyone else. We are happy to agree a disclosure date with you, and to coordinate any public write-up.

8.Not a vulnerability report?

If you want a security assessment of your own systems, please request an assessment. For anything else, see our contact page.

Related