Vulnerability Disclosure Policy

Email [email protected] with the word SECURITY in the subject line. Please include:

• What you found and why it matters
• The URL or service affected, and steps to reproduce it
• Any proof-of-concept detail that helps us confirm it quickly
• How we can reach you for follow-up

A machine-readable version of this contact is published at /.well-known/security.txt (RFC 9116).

This policy covers awi.ltd (this website) and the hosted services and subdomains operated by AWI Ltd.

Issues in the third-party platforms we build on (for example our hosting, CDN, email or analytics providers) are outside our control — please report those to the vendor concerned. If you are not sure whether something is in scope, send it to us anyway and we will route it.

• Test only against your own account and data. If you encounter data that is not yours, stop, do not read further or retain it, and tell us in your report.
• No denial-of-service, volumetric or resource-exhaustion testing.
• No social engineering, phishing or physical attacks against our team, customers or infrastructure.
• Do not run automated scanners at high intensity against production.
• Give us a reasonable opportunity to fix the issue before disclosing it publicly.

• We aim to acknowledge your report within five UK business days.
• We will tell you what we conclude, and keep you informed as we work on a fix.
• With your permission, we are happy to credit you once the issue is resolved.

We are a small team and do not currently run a paid bug bounty programme. We say that up front because we would rather be straight with you than imply a reward we do not offer.

If you make a good-faith effort to follow this policy, we will treat your research as authorised, will not pursue legal action against you for it, and will not report you to law enforcement for the act of researching and reporting. This does not extend to activity outside this policy — accessing other people’s data, service disruption, or extortion are never authorised.