Security Policy

1. Reporting a vulnerability

If you believe you have found a security vulnerability in a Secure7 website or service, please email contact (at) secure7.com. Machine-readable contact details are available in our security.txt.

Please include a description of the issue, the affected URL or component, the steps needed to reproduce it, and its potential impact. Please do not include real personal data in your report.

2. Scope

In scope: secure7.com and its subdomains, including the Polish-language pages.

Out of scope: denial-of-service or volumetric testing, automated mass submission of the contact form, social engineering or phishing of staff, physical attacks, and vulnerabilities in third-party services we rely on (for example Cloudflare or Formspree), which should be reported to those providers. Reports of missing best-practice headers without a demonstrable security impact are welcome but low priority.

3. What we ask of you

Please act in good faith: do not access, modify, or delete data that is not yours, do not degrade the service for other users, stop testing and tell us as soon as you encounter personal or confidential data, and give us a reasonable period to fix the issue before disclosing it publicly.

4. What you can expect from us

We aim to acknowledge your report within 3 business days, keep you informed of progress, and fix confirmed issues promptly. We will not pursue legal action against researchers who follow this policy in good faith. We would be glad to credit you once the issue is fixed, if you wish.

We do not currently operate a paid bug bounty programme.

5. Personal data

Personal data you send us in a report is processed in accordance with our Privacy Policy.