Security

Email [email protected] with the words “security report” in the subject line. Tell us what you found, where, and how to reproduce it. A proof of concept helps; a screenshot usually does not.

Please report privately and give us a chance to fix it before you publish. We will not take legal action against anyone who reports a genuine issue in good faith and does not exploit it further.

• An acknowledgement within five working days.
• An assessment and a rough timeline once we have reproduced it.
• Credit in the fix if you want it, and no mention of you if you do not.

• Run automated scanners or load tests against the live site. From our side they are indistinguishable from an attack.
• Access, modify or delete data that is not yours.
• Attempt social engineering against us, our clients or our suppliers.

Reports that amount to a missing best-practice header with no demonstrated impact, findings from an automated tool with no working exploit, or issues in third-party services we merely use, are usually not something we can act on. Send them anyway if you believe the impact is real, and explain why.

If you find a safety or security problem in one of our published hardware builds, that matters just as much as a web vulnerability. Same address, same commitment.