Report a security issue to HexaSec.

— 01Security issue reporting

Report a security issue to HexaSec.

HexaSec accepts reports of security issues discovered incidentally during ordinary, lawful use of HexaSec-owned services.

This policy does not authorise penetration testing, vulnerability scanning, exploitation or other security testing of HexaSec systems.

Prior written authorisation from HexaSec is required before conducting any security assessment.

Reporting

Accepted

Public pentesting

Not authorised

Automated scanning

Not authorised

Bug bounty

None

Testing authorisation

Prior written approval required

— 02Reporting route

Found something during normal use?

If you encounter a potential security issue while using a HexaSec-owned service normally, you may report it to:

info@hexasec.co.uk

Subject prefix: [Security]

Include:

• A clear description of the observed behaviour.
• The affected HexaSec URL, page, feature or service.
• The time the issue was observed.
• Minimal reproduction information where it arose during ordinary use.
• Relevant screenshots or technical details that you already possess.
• Your preferred contact details if you would like a response.

Do not continue testing, expand access or attempt exploitation in order to produce additional evidence.

— 03Testing authorisation

Reporting is not permission to test.

The existence of this page does not provide authorisation to conduct security testing against HexaSec.

The following do not constitute permission:

• A HexaSec system being publicly accessible.
• A hostname, domain, application or service being mentioned on this website.
• Submission or acknowledgement of a security report.
• Previous correspondence with HexaSec.
• Identification as a security researcher or penetration tester.
• The absence of a technical control preventing a particular action.

Only explicit prior written authorisation from HexaSec may authorise security testing.

Public security testing

Not authorised

Pentesting

Written authorisation required

Default position

Do not test

— 04Reportable systems

What you may report.

HexaSec will accept reports concerning security issues incidentally discovered in HexaSec-owned public systems or services.

This can include issues encountered on:

• hexasec.co.uk
• HexaSec-owned web applications.
• HexaSec-owned product interfaces made publicly accessible.
• Other systems where HexaSec has explicitly identified itself as the operator.

Third-party infrastructure, providers, customer environments and systems not operated by HexaSec are not authorised targets.

— 05Prohibited activity

Do not actively test HexaSec without permission.

Unless HexaSec has provided prior written authorisation, do not perform:

1. Vulnerability scanning or automated security assessment
2. Port scanning, service enumeration or infrastructure reconnaissance
3. Directory, endpoint, API or content enumeration beyond ordinary navigation
4. Fuzzing or malformed-input testing
5. Authentication bypass attempts
6. Credential stuffing, password spraying or brute-force activity
7. Exploitation of suspected vulnerabilities
8. Privilege escalation attempts
9. Accessing, modifying, downloading or retaining data you are not authorised to access
10. Denial-of-service, stress testing or resource exhaustion
11. Social engineering, phishing or impersonation
12. Malware, persistence mechanisms or payload deployment
13. Testing third-party services, suppliers, customers or infrastructure
14. Automated crawling or scraping for the purpose of vulnerability discovery

If you encounter unexpected access or sensitive information during ordinary use, stop and report the issue rather than investigating further.

— 06No safe harbour

No general research authorisation.

HexaSec does not operate a public vulnerability-disclosure testing programme and does not provide a general safe harbour for unauthorised security research.

Submitting a security report does not retrospectively authorise actions already taken and does not grant permission for additional testing.

Nothing on this page should be interpreted as consent to access a computer system, account, data or functionality beyond the access normally provided to you.

HexaSec reserves its rights in relation to activity performed without authorisation.

This policy is intended to provide a route for reporting security concerns, not to define authorised penetration-testing conditions.

— 07Response & bounties

Reporting does not create an engagement.

HexaSec reviews security reports as appropriate to the issue presented.

We do not guarantee:

• acknowledgement within a particular period;
• a response to every submission;
• remediation within a particular period;
• ongoing researcher updates;
• public recognition;
• payment or other reward.

HexaSec does not currently operate a public bug bounty or paid vulnerability disclosure programme.

Submission of a report does not create an entitlement to payment, compensation, employment, consultancy, acknowledgement or any other commercial relationship.

— 08Programme status

You do not need to confirm this policy by email.

The current published version of this page describes HexaSec's public security-reporting position.

You do not need to contact HexaSec to ask whether:

• the policy is active;
• the reporting route is current;
• you are permitted to begin testing;
• a particular HexaSec system is in scope for penetration testing;
• a bug bounty is available;
• HexaSec is accepting researcher registrations.

Unless HexaSec has separately provided you with written authorisation, the answer to requests for permission to conduct public security testing is:

Not authorised

If you have an actual security issue to report, use the reporting instructions above.

Report issue

info@hexasec.co.uk

Testing

Prior written authorisation

Bug bounty

None

Programme status

Reporting only