How to report
Use the contact form and begin the message with “SECURITY REPORT”. Include the affected URL or component, reproduction steps, impact, and any supporting evidence. Do not include personal data, credentials or live secrets. A dedicated encrypted channel should be added before inviting sensitive reports.
What you can expect
We aim to acknowledge a report within five working days, validate and triage it, keep the reporter informed when practical, and coordinate disclosure after remediation. We do not promise a reward or bug bounty unless agreed in writing.
Safe research expectations
Act in good faith; use only accounts and data you own or have permission to use; minimise access; stop when sensitive data is encountered; do not disrupt services, use social engineering, exfiltrate data, demand payment, or publicly disclose an unresolved issue.
Scope and protection
This policy covers this public website and services expressly identified by Fortentra. Third-party services are outside scope. Fortentra will not pursue action solely for accidental, good-faith research that follows this policy, but cannot authorise activity against third parties or waive obligations imposed by law.
Machine-readable contact
A security.txt file publishes the current contact and policy locations in the format recommended by the UK National Cyber Security Centre.