Greywell Cyber

Security

Vulnerability Disclosure Policy

Last updated 12 October 2026.

If you have found a security weakness in a Greywell Cyber website or tool, thank you. This page explains how to tell us and what we will do. It follows the shape of the NCSC's vulnerability disclosure toolkit and ISO/IEC 29147.

How to Report

Email security@greywellcyber.com. Please include:

  • what you found and where (the address of the page or endpoint)
  • the steps to reproduce it
  • what you think the impact is
  • how you would like to be credited, if at all

We are setting up a new encryption key for this address. Until it is published on our secure communications page, please send a short first message without the sensitive detail and we will agree a way to receive it.

In Scope

  • www.greywellcyber.com and greywellcyber.com
  • the free tools on this site and the server functions behind them
  • member sign in and the account page, using only accounts you registered yourself with addresses you control

Out of Scope

  • Denial of service, load testing or anything that degrades the service for others
  • Social engineering, phishing or physical attempts against anyone
  • Services run by our providers (Cloudflare, Supabase, Google); please report those to them
  • Registering accounts in bulk, or sending sign in codes to addresses that are not yours
  • Findings from automated scanners with no demonstrated impact, and missing best practice headers on pages that hold no data

Our Promise to You

  • We will acknowledge your report within five working days.
  • We will tell you what we plan to do and keep you updated until it is fixed.
  • We will credit you when we publish a fix, if you would like that.
  • If you act in good faith and follow this policy, we will not pursue or support legal action against you for your research.

What We Ask of You

  • Do no harm: do not access, change or delete data that is not yours, and stop once you have shown the issue. If you reach another member's data by accident, stop, tell us what you saw and delete any copy you hold.
  • Do not break the law or our acceptable use policy.
  • Give us 90 days, or until a fix is out if that is sooner, before you share details publicly. We will agree a different date with you if there is good reason.

We do not run a paid bug bounty.

This policy is also published in machine readable form at /.well-known/security.txt.