Compteck Solutions values responsible security research and encourages potential security issues affecting its publicly accessible website or systems to be reported responsibly.

The purpose of this policy is to support constructive security reporting while helping protect users, data, systems and services.

Reporting a Potential Vulnerability

If you believe you have identified a potential security vulnerability relating to a Compteck Solutions website or publicly accessible system, please use our Contact Us page to initiate communication.

In the initial message:

• Identify the enquiry as a security or vulnerability report
• Provide a brief, non-sensitive description of the issue
• Identify the affected page, service or endpoint where appropriate
• Provide a reliable method for us to contact you
• Do not include passwords, customer data, authentication credentials, exploit payloads or other sensitive information in the initial general enquiry

Where necessary, a more appropriate communication method may be arranged for additional technical information.

Responsible Research Guidelines

Security research should:

• Be conducted in good faith
• Minimise impact on systems, services and users
• Access only the minimum information necessary to demonstrate a potential issue
• Stop testing if personal, confidential, customer or authentication information is encountered
• Avoid retaining, copying or distributing information obtained unintentionally
• Avoid disrupting or degrading services
• Provide sufficient information for the issue to be understood and investigated
• Allow a reasonable opportunity for investigation and remediation before public disclosure
• Comply with applicable law

Prohibited Activities

This policy does not authorise:

• Denial-of-service or traffic-flooding tests
• Destructive or disruptive testing
• Malware deployment
• Social engineering, phishing or impersonation
• Password attacks, credential stuffing or account takeover attempts
• Intentional access to unrelated user, employee, customer or third-party information
• Modification, deletion or destruction of data
• Establishing persistence within systems
• Deliberate privacy violations
• Extortion, threats or demands for payment
• Testing systems operated by third parties merely because they are linked from this website
• Activity that intentionally creates operational disruption, material cost or service degradation

Sensitive Information

If personal, confidential, customer, authentication or other sensitive information becomes visible during security research:

1. Stop testing
2. Do not modify, download, copy or distribute the information
3. Report the issue through the appropriate channel
4. Securely remove any information retained unintentionally when appropriate

What to Include in a Report

Where safe and appropriate, a vulnerability report may include:

• The affected page, URL, service or endpoint
• A clear description of the potential vulnerability
• Steps required to reproduce the issue
• Expected behaviour and observed behaviour
• Potential security impact
• Relevant screenshots with sensitive information removed
• Suggested remediation, if available

Public Disclosure

Researchers are requested not to publish or otherwise disclose vulnerability details before Compteck Solutions has had a reasonable opportunity to investigate and address the reported issue.

Some issues may require additional time where remediation depends on system complexity, suppliers or third-party technology.

No Bounty Commitment

Submission of a vulnerability report does not create an entitlement to payment, reward, employment, contract or other compensation unless Compteck Solutions expressly agrees otherwise in writing.

Good-Faith Reports

Reports made genuinely, responsibly and in accordance with this policy will be treated as good-faith security communications.

This policy does not authorise activity that is unlawful or outside the scope described above.

Third-Party Systems

This policy applies only to systems and services operated or controlled by Compteck Solutions unless another system is expressly identified as being within scope.

Third-party services, platforms and infrastructure remain subject to the security and disclosure policies of their respective operators.

Changes to this Policy

Compteck Solutions may revise this policy when its systems, services, security practices or applicable requirements change.

The version available on this website represents the applicable Responsible Disclosure Policy.

Contact

To initiate a responsible security report, please use the Contact Us page and clearly identify the enquiry as a security or vulnerability report.

---

Back to Legal & Policies