How to report
Email info@clipeumit.com with the subject line "Security report". Include the affected address or system, the steps to reproduce the issue, and what you think the impact is. Please do not include more data than you need to demonstrate the problem.
In scope
- The website at www.clipeumit.com and its forms.
- Other web services we operate under the clipeumit.com domain.
Out of scope
- Systems that belong to our customers, suppliers or other third parties, including Tawk.to, Microsoft, Vercel and Google.
- Social engineering or phishing of our staff or customers.
- Physical attacks against our offices.
- Denial of service, spam, or automated high volume scanning.
- Reports that only describe missing best practice with no demonstrable security impact.
Our commitment
- We will acknowledge your report within 3 working days.
- We will keep you updated on progress and tell you when the issue is fixed.
- We will treat your report as confidential and only share it as needed to fix the problem.
- If you wish, we will credit you once the issue is resolved.
Safe harbour
If you act in good faith and follow this policy, we will not take legal action against you or ask the authorities to investigate you for your research. This applies only to testing within the scope above. It does not give permission to break the law or to access data that is not yours.
What we ask you not to do
- Do not access, change, copy or delete data that is not yours.
- Do not disrupt our services or degrade them for other users.
- Do not publish details of the issue before we have had a reasonable chance to fix it.
- Do not demand payment. We do not run a paid bug bounty programme.
Contact
Questions about this policy can go to info@clipeumit.com or 0333 996 4264. Our machine-readable contact details are in our security.txt file.