Security disclosure and incident contact
How to report a suspected vulnerability or data incident without putting customers or evidence at further risk.
Draft · monitored production contact pending
Reporting route
A monitored security email, PGP key, acknowledgement target and emergency escalation number will be published before production. Until then, do not send credentials, tokens, private keys, personal information or exploit payloads to an unverified address.
Requested report content
- Affected URL/component and observed date/time.
- Clear reproduction steps using synthetic data.
- Expected and observed impact.
- Any non-sensitive logs, request IDs or screenshots.
- A safe contact route and disclosure expectations.
Safe-harbour intent
Final counsel-approved language will cover good-faith research, privacy, data minimisation, no persistence/exfiltration, no social engineering or denial of service, reasonable time to remediate and coordinated disclosure. It cannot authorise conduct prohibited by law or another provider's systems.
Customer incidents
Customers should use the authenticated support/incident route in their final order. Security compromises involving personal information will be handled under the final POPIA role allocation and notification process.