Report a Security Issue

If you think you have found a security problem in something Ceidwad runs, we would like to hear about it. This page says how to tell us and what we ask of you.

How to report

Email security@ceidwad.co.uk. Please use this address rather than the form on our contact page. The same details are published in machine-readable form at /.well-known/security.txt.

What to include

• Where the problem is: the address of the page or service, and the affected feature.
• What you did, step by step, so we can repeat it.
• What you saw happen, and what you think an attacker could do with it.
• Screenshots or a short recording, if they help.
• How to reach you, and whether you would like to be credited once it is fixed.

Please do not send us other people's personal data as proof. Describing it is enough.

What is in scope

• The Ceidwad website at ceidwad.co.uk, and the other Ceidwad websites.
• The Craidd service, including craidd.ceidwad.co.uk and its sign-in.

What is out of scope

• Social engineering or phishing of Ceidwad staff, customers or anyone else.
• Denial of service, or any testing that could slow or interrupt the service.
• Physical attacks on offices, homes or equipment.
• Third-party services we use, such as a supplier's own products. Please report those to the supplier. If you are not sure whether something is ours, tell us and we will pass it on.
• Automated scanner output with no explanation of the real-world impact.

What to expect from us

We will acknowledge your report, look into it, and keep you informed as we work out what happened and what to do about it. We cannot promise a particular timescale, because it depends on what is found. We do not offer payment or rewards for reports. If you would like to be credited once a problem is fixed, say so, and with your permission we will name you on this page.

What we ask of you

• Act in good faith, and test only against your own accounts and data where you can.
• Do not access, change, copy or delete other people's data. If you reach data that is not yours, stop, and report what you found.
• Do not disrupt the service for other people.
• Give us a reasonable chance to fix the problem before you tell anyone else about it, and we'll agree a disclosure date with you.

Our intent

We do not intend to take legal action against someone who finds and reports a problem in good faith and keeps to the rules on this page. This is a statement of intent, not a guarantee, and it does not cover anything outside these rules or anything that breaks the law.

Looking for something else? Use the form on our contact page.