Security & Responsible Disclosure — Report Safely

1. Security approach

Site Guard 365 uses reasonable safeguards and encourages responsible reporting. No public-facing system can be guaranteed free of vulnerabilities. This page is not permission to test client systems or third-party providers.

2. In-scope assets

Unless separately listed in writing, only the public Site Guard 365 website is in scope. Client websites, hosting, advertising/social accounts, email systems, employee devices and third-party SaaS are out of scope.

3. Research rules

• Act in good faith and stop when you encounter personal data, credentials, secrets or evidence of compromise.
• Do not access, change, download, delete or exfiltrate data beyond the minimum needed to demonstrate the issue.
• Do not use denial-of-service, spam, social engineering, malware, credential stuffing or high-volume automated scanning.
• Do not create persistence, pivot to another system, test third-party infrastructure or disrupt service.
• Use only accounts and data you own or are authorised to use.
• Do not demand payment, threaten disclosure or publish details before coordination.

4. How to report

Email policy@siteguard365.com with subject “Security Vulnerability Report”. Include affected URL, reproduction steps, impact, screenshots or minimal proof of concept, date/time and contact details. Do not include full datasets, live credentials or destructive payloads.

5. What to expect

We aim to acknowledge credible reports within 3 business days and triage them according to severity. Remediation timing depends on complexity and third-party dependencies. These are goals, not a contractual service level.

6. Good-faith research

Where research is lawful, follows this Policy and is reported promptly, Site Guard 365 will not intentionally pursue a complaint solely for that authorised good-faith testing. This does not bind third parties or protect actions outside scope.

7. No automatic bounty

There is no guaranteed paid bug-bounty programme. Any recognition or reward is discretionary and must be agreed in writing. Duplicate, automated-only, low-impact and out-of-scope reports may receive no reward.