Security Vulnerability Disclosure Policy

Reporting a Security Vulnerability

We take the security of our systems, websites, and customer data seriously. If you believe you have discovered a security vulnerability affecting any of our services, we encourage you to report it responsibly.

How to Report

Please submit vulnerability reports to:

Email: getintouch@bournemouthexplorers.org.uk

When reporting an issue, please include:

• A detailed description of the vulnerability.
• The affected website, service, or page.
• Steps required to reproduce the issue.
• Proof-of-concept code, screenshots, or logs where appropriate.
• Your contact details should we need further information.

What We Ask of Security Researchers

To help us investigate and resolve issues effectively, please:

• Act in good faith.
• Avoid accessing, modifying, or deleting data that does not belong to you.
• Avoid actions that could negatively impact the availability or performance of our services.
• Do not attempt social engineering, phishing, physical security attacks, or denial-of-service testing.
• Do not publicly disclose the vulnerability until we have had a reasonable opportunity to investigate and remediate the issue.
• Provide us with sufficient information to reproduce and validate the finding.

Our Commitment

When a vulnerability is reported responsibly, we will:

• Acknowledge receipt of the report.
• Investigate the issue as quickly as reasonably possible.
• Keep the reporter informed of progress where appropriate.
• Work to remediate confirmed vulnerabilities.

Out of Scope

The following activities are not permitted under this policy:

• Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) testing.
• Spam, social engineering, or phishing attacks.
• Physical attacks against facilities or personnel.
• Testing against third-party systems not owned or operated by us.
• Accessing, downloading, modifying, or destroying data belonging to others.

Legal Safe Harbour

We will not pursue legal action against individuals who:

• Follow this policy.
• Act in good faith.
• Avoid privacy violations, service disruption, and data destruction.
• Promptly report discovered vulnerabilities.

Response Times

We aim to:

• Acknowledge vulnerability reports within 5 business days.
• Provide an initial assessment within 10 business days where possible.

Actual response times may vary depending on the complexity and severity of the issue.

Contact

For all security-related matters:

getintouch@bournemouthexplorers.org.uk