Vulnerability Disclosure Policy
Last updated: 14 September 2025
This policy explains how to report security vulnerabilities in Technophobia Ltd websites and services. We welcome good-faith reports and commit to fair, prompt handling.
1. How to report
- Email hello@technophobia.uk with “Security issue” in the subject.
- Include steps to reproduce, affected host/URL, impact, and any screenshots or PoC.
- Encrypt if you prefer; ask for our PGP key.
2. Safe harbour
- If you follow this policy and act in good faith, we will not pursue legal action.
- We will consider your research authorised for anti-circumvention and similar laws, to the extent allowed.
3. In scope
- Domains we operate such as technophobia.uk and our managed subdomains.
- Hosted demo instances where listed by us.
4. Out of scope
- Third-party services not run by us (report to the relevant provider).
- Denial of Service, spam, or social engineering of our staff or clients.
- Findings that only impact outdated browsers or need physical access.
5. Testing rules
- No data exfiltration beyond minimal proof. Do not access other people’s data.
- No service disruption, phishing, or intrusive scanning.
- Use test accounts where possible and keep volumes low.
6. What we commit to
- Acknowledge your report within 5 working days.
- Keep you updated at key points (triage, fix planned, fix released).
- Give fair credit if you want to be named.
7. Acknowledgement
- We do not run a bounty programme. We may offer thanks on our site.
8. security.txt
Create this file at /.well-known/security.txt:
Contact: mailto:hello@technophobia.uk
Policy: https://technophobia.uk/vulnerability-disclosure-policy
Preferred-Languages: en
Canonical: https://technophobia.uk/.well-known/security.txt
Expires: 2026-09-14T23:59:59Z
9. Contact
Technophobia Ltd · Company No. 14898332 · VAT GB 495 7043 58
13B Devonshire Road Industrial Estate, Millom, LA18 4JS, United Kingdom
+44 1229 774591 • hello@technophobia.uk