Security & Responsible Disclosure

1. Scope

This policy covers the lab website and the services the lab operates directly. Third-party platforms, partner systems and linked repositories are out of scope; report issues there to the operator responsible.

2. Reporting a vulnerability

Send reports to [Placeholder: security contact email]. Please do not open a public issue, post details on social media or test against data that does not belong to you.

A useful report includes:

• The affected URL, service or component.
• A clear description of the issue and its potential impact.
• Reproduction steps or a minimal proof of concept.
• Your contact details for follow-up.
• Whether you wish to be credited, and under what name.

3. How we respond

Acknowledgement

We aim to acknowledge a report within 3 working days.

Triage

We confirm scope, severity and a remediation plan within 10 working days where possible.

Fix

Timelines depend on severity and complexity; we keep you informed of material progress.

Disclosure

We coordinate public disclosure with you after a fix is available, or at an agreed date.

4. Safe harbour

If you act in good faith under this policy — stay within scope, avoid privacy violations and service disruption, and give us reasonable time to fix the issue — the lab will not pursue legal action or report you to authorities for your research. This commitment does not protect deliberate harm, extortion or access to data beyond what is needed to demonstrate the issue.

5. Out of scope

• Reports generated solely by automated scanners without a demonstrated impact.
• Missing security headers or best-practice suggestions with no exploit path.
• Social engineering, phishing or physical attacks against staff.
• Denial-of-service testing or any activity that degrades the service.
• Issues in third-party services or dependencies that are not exploitable in the lab.

6. Recognition

With your permission, we credit valid reports in the lab’s security acknowledgements. The lab does not currently operate a paid bounty programme and will say so clearly if that changes.

7. Contact

Security reports should go to [Placeholder: security contact email]. General governance questions go to [Placeholder: lab governance contact email].