Skip to content

Responsible disclosure

We are a security company and we hold our own systems to the standard we test others against. If you find a vulnerability, please tell us privately first.

How to report

Email info@eligencybersecurity.org with a description of the issue, the affected URL or system, steps to reproduce and any proof of concept. Our security.txt lists the same contact.

In scope

  • eligencybersecurity.org, including its subdomains
  • The public forms and the admin sign in page

Please do not

  • Access, change or delete data that is not yours, or keep it after testing
  • Run denial of service, spam or social engineering against our staff
  • Test client systems we manage: they are not ours to authorise
  • Disclose the issue publicly before we have fixed it

Our commitment

  • Acknowledge your report within two working days
  • Keep you informed until the issue is resolved
  • Not pursue legal action for good faith research that follows this policy
  • Credit you publicly if you wish, once the fix is live