Found a vulnerability? Tell us.

How to report

Email [Security email address] with:

• a description of the issue and where it is;
• the steps to reproduce it, with any proof of concept;
• the impact you believe it has; and
• how you would like to be credited, if at all.

Please do not include personal data you may have accessed beyond what is needed to show the issue.

What we commit to

• Acknowledge your report within three working days.
• Keep you informed while we investigate and fix it.
• Credit you publicly once it is fixed, if you would like that.

Please

• Give us reasonable time to fix the issue before disclosing it.
• Do not access, change or delete data that is not yours, and stop once you have shown the issue.
• Do not run denial-of-service, spam or social-engineering tests, or test physical security.

Good faith

If you follow this policy, we will treat your research as authorised and in good faith, and we will not pursue action against you for it.

Scope

This website and any systems Frontier 7 operates. Systems we have built for clients belong to those clients; report issues in them to the client directly, or to us and we will pass the report on with your permission.

Machine-readable contact details: /.well-known/security.txt. We do not currently run a paid bug bounty.