Security
Vulnerability Disclosure Policy
DeGoyle welcomes responsible reports of security issues affecting degoyle.com and related DeGoyle infrastructure. This Vulnerability Disclosure Policy (“VDP”) sets out how to report an issue, what you can expect from us, and what we ask from you.
1. How to report
To report a suspected security vulnerability, email support@degoyle.com with the subject line: [Security] Vulnerability Report.
Please include:
- A clear description of the issue.
- The URL, endpoint or component affected.
- Steps to reproduce the issue, or proof-of-concept if available.
- The potential impact, as you understand it.
- Your name or handle, if you are willing to be credited.
You are not required to provide a proof-of-concept to make a report. Partial or uncertain reports are still welcome.
2. What we will do
We will aim to:
- Acknowledge your report within 5 business days.
- Investigate and assess the reported issue in good faith.
- Keep you informed of progress where appropriate.
- Resolve confirmed vulnerabilities in a risk-proportionate timeframe.
- Credit reporters publicly if requested and where appropriate, unless you prefer to remain anonymous.
We will not take legal action against researchers who report in good faith and in accordance with this policy.
3. Scope
This policy covers:
- degoyle.com and its subdomains.
- The DeGoyle public website, forms and associated infrastructure.
This policy does not cover:
- Third-party infrastructure providers (Render, Neon, Make, Cloudflare). Report issues with those services directly to their own security teams.
- Future customer platform environments — those will be covered under a separate or updated policy when available.
4. Out-of-scope activity
The following activities are not permitted under this policy:
- Denial-of-service or availability testing.
- Social engineering of DeGoyle staff, users or service providers.
- Physical security testing.
- Credential stuffing, brute-force or password-spray attacks.
- Accessing, modifying, deleting or exfiltrating data that does not belong to you.
- Testing against third-party infrastructure or services.
- Any activity that disrupts the website or affects other users.
5. Safe harbour
DeGoyle will not pursue legal action against security researchers who:
- Report in good faith in accordance with this policy.
- Do not access, modify, delete or exfiltrate data that does not belong to them.
- Do not conduct out-of-scope activities.
- Do not publicly disclose the issue before DeGoyle has had a reasonable opportunity to investigate and respond.
This safe harbour applies to the extent permitted by applicable law.
6. Disclosure timeline
We ask that you give us a reasonable time to investigate and respond before public disclosure. As a general guide, we aim to resolve confirmed issues within 90 days of acknowledgement. If you believe an issue is being handled unreasonably, contact us to discuss. We support coordinated disclosure.
Contact
To report a vulnerability: