> cat /policy/responsible-disclosure.txt_
Found something? Good. We'd rather hear it from you than find out the hard way. Here's how to tell us about it safely, and what you can expect in return.
At Hedgehog Security, we practice what we preach. We believe that security researchers acting in good faith are a vital part of the security ecosystem, and we actively encourage the responsible reporting of vulnerabilities discovered in our systems and infrastructure.
This policy sets out our commitment to working with the security community, defines the scope of what you may test, explains how to report findings, and describes the protections we offer to researchers who follow these guidelines.
If you conduct security research in accordance with this policy, we consider your activities to be authorised. We will not pursue legal action against you, we will not report your activities to law enforcement, and we will work with you in good faith to understand and resolve the issue.
If a third party initiates legal action against you for activities that were conducted in compliance with this policy, we will take reasonable steps to make it known that your actions were authorised by us.
Please send all vulnerability reports to our dedicated security inbox. We strongly encourage the use of our PGP key to encrypt sensitive details.
Your report should include:
To help focus your efforts and keep everyone safe, please review the scope boundaries below. If you're unsure whether something is in scope, ask us before testing — we're happy to clarify.
| In Scope | Notes |
|---|---|
| *.hedgehogsecurity.co.uk | All subdomains of our primary domain |
| Web application vulnerabilities | XSS, SQLi, CSRF, IDOR, authentication flaws, etc. |
| API security issues | Broken authentication, injection, mass assignment, etc. |
| Server misconfigurations | TLS issues, exposed admin panels, directory listing, etc. |
| Business logic flaws | Privilege escalation, access control bypasses |
| Out of Scope | Reason |
|---|---|
| Denial of Service (DoS/DDoS) | We don't want you to take us offline — and neither do our clients |
| Social engineering of staff | Phishing, vishing, or physical social engineering against our team |
| Physical security testing | Do not attempt to access our offices or data centres |
| Third-party services | Vulnerabilities in services we use but don't control (e.g. CDN, SaaS) |
| Automated scanning at scale | Aggressive automated scanners disrupt our services — use targeted testing |
| SPF/DKIM/DMARC misconfigurations | Unless demonstrably exploitable for meaningful impact |
| Missing security headers | Unless you can demonstrate concrete, exploitable impact |
| Self-XSS | Vulnerabilities requiring the victim to paste code into their own browser |
When conducting your research, you must:
We take every report seriously. Here's our commitment to you on response times — all times are working days, UTC.
We'll confirm we've received your report and assign it a tracking reference. You'll have a named point of contact for all further correspondence.
We'll validate the vulnerability, assess its severity using CVSS, and provide you with an initial assessment. We may ask follow-up questions during this phase.
We aim to remediate confirmed vulnerabilities within 30 working days of triage. Critical and high-severity issues are fast-tracked. We'll keep you informed of progress.
Once the fix is deployed and verified, we'll notify you and — with your permission — add your name to our Hall of Fame. You'll be the first to know when it's safe to disclose.
We believe in recognising the contributions of security researchers. While we do not currently operate a paid bug bounty programme, we offer the following to researchers who submit valid reports in accordance with this policy:
We are actively considering the introduction of a formal bug bounty programme. If you have thoughts on this, we'd love to hear from you.
Don't sit on it. Drop us a line and let's make things more secure — together.