Responsible Disclosure

Last updated: 22 September 2026

As a security company, we hold ourselves to the same standard we assess our clients against. If you believe you’ve found a security issue in this website or our supporting infrastructure, we want to hear about it, and we’ll treat your report seriously and respectfully.

Scope

This policy covers:

This website, attacksurfacecheck.com and its subdomains.
Infrastructure that we operate and control in support of it (for example, our mail systems for this domain).

It does not cover third-party services we merely use (for example, our email-delivery provider’s own infrastructure). Please report issues in those services directly to their respective owners.

What we ask

Give us a reasonable opportunity to investigate and respond before any public disclosure.
Avoid actions that could degrade the availability or integrity of our systems, or affect other users: no denial-of-service testing, no automated bulk scanning, no destructive testing.
Do not access, modify, or exfiltrate data that isn’t yours. If a finding could expose real data, stop at the point of confirmation and report it. Do not go further.
Do not use social engineering, physical access attempts, or attacks against our staff, partners, or their personal accounts.
Interact only with systems in scope. If you’re unsure whether something is in scope, ask us first.

Safe harbor

We will not pursue legal action against researchers who make a good-faith effort to comply with this policy, report findings responsibly, and avoid privacy violations, service disruption, and data destruction. If legal action is initiated by a third party against you for activities conducted in good-faith compliance with this policy, we will make that known.

How to report

Email security@attacksurfacecheck.com with:

A clear description of the issue and its potential impact.
Steps to reproduce it, including any request/response details, proof-of-concept, or screenshots that help us confirm it quickly.
The URL, endpoint, or system affected.
Your contact details, so we can follow up.

What to expect from us

An acknowledgment of your report within a few business days.
An honest assessment of severity and, where useful, updates as we work on a fix.
Credit, if you’d like it, once the issue is resolved. We’re happy to name researchers who help us improve, with your permission.

We don’t currently run a paid bug bounty program, but we genuinely appreciate researchers who take the time to report responsibly, and will publicly thank them if they’d like.

Out of scope

Issues that generally don’t need a report: missing security headers or best-practice hardening suggestions without a demonstrated impact, results from automated scanners without manual verification, theoretical vulnerabilities without proof of exploitability, and reports about third-party services we merely link to.

Thank you for helping keep this site, and by extension our own house, in order.