Security and vulnerability disclosure

How to report

Email security@softlander.co. Include the URL, the steps to reproduce, the impact you observed and how we can reach you. Encrypted email is available on request. A machine-readable version of this policy is at /.well-known/security.txt.

Scope

• In scope: softlander.co, www.softlander.co, the inquiry endpoint under /api/, and email authentication (SPF, DKIM, DMARC) for softlander.co.
• Out of scope: third-party services we use (report those to the vendor), denial of service, social engineering, physical attacks, and automated scanner output without a demonstrated impact.

Our commitments

• We acknowledge a report within 3 working days.
• We give a status update within 10 working days.
• We credit you on request once the issue is fixed.

Safe harbour

If you act in good faith, stay within scope, avoid privacy violations and service disruption, and give us reasonable time to fix an issue before disclosing it, we will not pursue legal action and will treat your research as authorised.

Bounty

We do not currently run a paid bug bounty.

How we protect client evidence

The handling of client material during engagements is agreed in writing before anything is shared; see contracting and delivery.