This notice provides a reporting channel only. It is not permission to scan, exploit, stress test, access customer information, or investigate systems you do not own.
What to report
If you notice a credible security issue in a Defendoria-owned public website, please describe the affected URL or feature, the visible behavior and why you think it presents a security concern. Only share information you can lawfully disclose.
How to report it
Use the contact form and select the most relevant topic. Do not place passwords, authentication tokens, exploit payloads, personal records, screenshots of confidential content or detailed attack instructions in the public form. If sensitive evidence is required, request an appropriate secure exchange method.
Activities not authorized
- Automated vulnerability scanning, aggressive request testing or denial-of-service activity.
- Attempting to access accounts, databases, administrative panels or nonpublic information.
- Modifying, deleting, transferring or publishing data.
- Social engineering staff, customers or service providers.
- Public disclosure of a potential vulnerability before an agreed coordinated process.
After a report
Reports may be triaged according to the available information and operational priorities. This page does not promise a bounty, monetary reward, vulnerability acceptance, safe-harbor protection or a fixed response deadline.
Our services and client systems
If you need an authorized audit for a website you own, use the Security Audit service instead. Permission to test client environments is decided separately for each engagement.