Responsible disclosure policy

We take the security of our own systems seriously. If you believe you have found a vulnerability in this website, our infrastructure, or something we have published, we want to hear from you.

How to report

• Email security@spectrumsec.eu, encrypted to our PGP key where possible. Key fingerprint: E293 9206 FDF7 EE82 960C E276 004C 0AA0 E805 EB53.
• Include enough detail to reproduce the issue: URLs, payloads, and the impact you observed.
• Please give us a reasonable time to remediate before any public disclosure.

Scope

In scope: spectrumsec.eu and its subdomains, and content we author.

Out of scope: findings that require physical access, social engineering of our staff, denial-of-service testing, automated scanner output without a demonstrated impact, and third-party services we link to.

Our commitment

• We will acknowledge your report within 3 working days.
• We will keep you updated on remediation progress.
• We will credit you (if you wish) once the issue is resolved.
• We will not pursue legal action for good-faith research that respects this policy.

Not a bug bounty

We do not currently operate a paid bounty programme, but we are grateful for every good-faith report and will acknowledge contributions publicly.