Smart VAPT
Menu

Responsible disclosure policy

Last updated: 25 October 2026

We test other organisations’ security for a living, so we hold our own to the same standard. If you believe you have found a security vulnerability in any system covered by this policy, we want to hear about it, and we will work with you to fix it quickly.

Scope

In scope

  • www.smartvapt.com and smartvapt.com
  • api.smartvapt.com (our quote form and website services)

Out of scope

  • Third-party services we use but don’t control, such as our hosting provider, analytics, spam protection or social media platforms. Please report issues in those directly to the provider.
  • Any client systems, and any systems not listed above
  • Physical security testing, and social engineering of anyone (phishing, phone calls or impersonation)
  • Denial-of-service testing, or anything that degrades the service for others
  • Findings with no demonstrable security impact, such as:
    • missing best-practice headers or cookie flags where nothing is exploitable
    • TLS cipher preferences or version support
    • self-XSS, clickjacking on pages with no sensitive actions, or logout CSRF
    • email configuration (SPF, DKIM, DMARC) reports without a working spoofing proof
    • output from automated scanners without verification
    • software version disclosure without a related exploitable vulnerability

How to report

Email info@smartvapt.com with the subject line “Security vulnerability report”. Please include:

  • the affected URL or system
  • a description of the vulnerability and its potential impact
  • clear steps to reproduce it, with any proof-of-concept, screenshots or requests and responses
  • how you would like to be credited, if at all

Please write in English. If you would like to encrypt your report, ask us for our PGP key first [OR: our PGP key is available at /.well-known/pgp-key.txt].

Please do

  • test only within the scope above, and use only the minimum access needed to demonstrate the issue
  • stop and report as soon as you have confirmed a vulnerability
  • use test accounts or your own data where possible
  • if you encounter personal or confidential data, stop, don’t copy, keep or share it, and tell us in your report
  • give us reasonable time to fix the issue before telling anyone else about it

Please don’t

  • access, change or delete data that isn’t yours
  • run high-volume or destructive automated scans
  • use any vulnerability beyond what is needed to prove it exists, for example to move further into our systems
  • demand payment or any other benefit in exchange for your report
  • publicly disclose the issue before we have fixed it or agreed a disclosure date with you

What we will do

  • Acknowledge your report within 3 working days
  • Assess it and tell you our initial view within 10 working days
  • keep you updated while we work on a fix, and tell you when it is resolved
  • agree a coordinated public disclosure date with you if you wish to publish, normally within 90 days of your report
  • credit you publicly for the find, with your permission

We are a small company and don’t currently run a paid bug bounty, so we can’t offer financial rewards.

If you act in good faith and follow this policy, we will:

  • treat your research as authorised by us for the purposes of this policy, and not take legal action against you or report you to law enforcement for it
  • tell anyone else who takes action against you that you acted in line with this policy

This policy cannot authorise testing of systems we don’t own, and it does not override the law. Please make sure your activity complies with the Computer Misuse Act 1990 and any other laws that apply where you are. If you are unsure whether something is allowed, ask us first at info@smartvapt.com.

security.txt

Our contact details for security reports are also published in machine-readable form at https://www.smartvapt.com/.well-known/security.txt (RFC 9116).