Affected Service
Domain, page, endpoint, application or system component.
Responsible Disclosure
Report suspected security vulnerabilities safely
SeySecure values responsible security research and encourages good-faith reporting of suspected vulnerabilities affecting its public websites, applications or authorised services.
Policy Scope
Public SeySecure systems and authorised services
This policy applies to public SeySecure websites, applications and services explicitly owned or operated by SeySecure Technologies Ltd.
Client systems, government platforms, third-party services and partner infrastructure are not automatically included. Testing those environments requires prior written authorisation from the responsible owner.
Where ownership is unclear, contact SeySecure before conducting any testing.
Reporting a Vulnerability
Provide enough information for effective investigation
Reports should be clear, factual and limited to the information necessary to explain the suspected issue.
Primary security contact
security@seysecuretech.com
Use a descriptive subject such as:
Security Report — [Affected Service] — [Issue Type]
Information to Include
A complete report helps reduce investigation time
Do not include passwords, private keys or unnecessary personal information in the initial report.
Issue Description
Clear explanation of the suspected vulnerability.
Reproduction Steps
Minimal sequence required to reproduce the issue safely.
Observed Impact
Confidentiality, integrity, availability or operational effect.
Supporting Evidence
Screenshots, request details or logs with secrets removed.
Researcher Contact
A reliable email address for coordinated follow-up.
Good-Faith Security Research
Testing must remain proportionate and non-disruptive
Security research should be limited to confirming a suspected vulnerability while avoiding harm to systems, users and data.
Prohibited Activities
Activities that create risk or exceed good-faith research
This policy does not authorise disruptive, destructive or privacy-invasive activity.
Service Disruption
Denial-of-service, resource exhaustion or availability attacks.
Social Engineering
Phishing, impersonation or manipulation of staff or users.
Credential Attacks
Password spraying, brute force or unauthorised account access.
Data Extraction
Downloading, copying or exposing unnecessary information.
Malware Deployment
Uploading malicious code, persistence or destructive payloads.
Physical Intrusion
Attempting unauthorised access to offices, devices or facilities.
Third-Party Testing
Testing providers or client systems without written permission.
Public Disclosure Before Coordination
Publishing unresolved vulnerabilities without reasonable notice.
Extortion or Threats
Demanding payment or benefit in exchange for withholding disclosure.
SeySecure Response Process
Coordinated review from acknowledgement to resolution
Response times may vary according to severity, complexity, ownership and operational impact.
-
01
Acknowledge
Confirm receipt where a valid contact address is provided.
-
02
Triage
Assess scope, severity, ownership and reproducibility.
-
03
Investigate
Validate technical details and affected components.
-
04
Contain
Apply temporary controls where immediate risk exists.
-
05
Remediate
Correct the issue and perform appropriate validation.
-
06
Coordinate Closure
Confirm outcome and discuss disclosure where appropriate.
Severity and Prioritisation
Response priority reflects actual risk
SeySecure considers exploitability, affected data, user impact, business criticality, exposure and available controls.
Recognition
Professional acknowledgement may be considered
SeySecure may acknowledge researchers who provide useful, original and responsibly disclosed findings, subject to consent and organisational policy.
No automatic reward programme
This policy does not establish a bug-bounty programme, payment obligation, contractual relationship or guarantee of public recognition.
Any reward, acknowledgement or publication remains entirely at SeySecure’s discretion and must be agreed in writing.
Good-Faith Consideration
Responsible conduct matters
SeySecure will consider the researcher’s intent, proportionality, compliance with this policy and efforts to avoid harm when evaluating a reported activity.
Security Reporting