Security & responsible disclosure

Scope of this policy

This policy covers systems operated by BastionWolf, including this website and the infrastructure that serves it. It does not cover systems belonging to our clients. If you have found an issue in a client's system, please report it to that organisation directly; we cannot authorise testing on their behalf.

Authorised testing only

Testing any system without the owner's permission is unlawful in most jurisdictions. This page is not a grant of permission to test, and BastionWolf does not operate a bug bounty programme. If you have already observed something, for example while using this website normally, we welcome the report.

If you want to test our systems deliberately, contact us first and we will tell you whether and on what terms that is possible.

What we ask of you

• Report what you find promptly, and give us reasonable time to respond before disclosing it anywhere else.
• Access only the minimum data needed to demonstrate the issue. Do not download, copy, modify or retain data belonging to us or anyone else.
• Do not degrade our services. No denial-of-service, no automated scanning that generates significant load, no spam or social engineering of our people, clients or suppliers.
• Do not use the issue to pivot further into our infrastructure once you have confirmed it exists.
• Stop and contact us immediately if you encounter personal data, credentials or client material.
• Stay within the law.

What to include in a report

The more reproducible the report, the faster we can confirm and fix it. Please include:

• The affected URL, endpoint or component
• A clear description of the issue and its likely impact
• Step-by-step reproduction instructions, including any required requests
• The date and time of your testing and the source IP you used
• Any supporting evidence, such as requests, responses or screenshots
• How you would like to be credited, if you would like to be

What you can expect from us

• An acknowledgement that we have received your report.
• An assessment of the issue and confirmation of whether we can reproduce it.
• Updates on remediation progress where it is appropriate to share them.
• No legal action against researchers who follow this policy in good faith, act within the law and avoid harm to our systems, our people and our clients.

Out of scope

Reports consisting only of automated scanner output, missing security headers with no demonstrated impact, issues requiring a fully compromised device or browser, and theoretical findings without a working proof of concept are unlikely to be actioned.