Security reporting

This page is the human-readable companion to our machine-readable /.well-known/security.txt (canonical location: https://glabit.com/.well-known/security.txt). If the two ever disagree, tell us — and treat the more restrictive statement as the one that applies until we have corrected it.

No permission to test — read this first

Scope (for receiving reports)

Scope is defined by who controls the system, not by what serves the website. Listing a system here does not authorise anyone to test it.

• Eligible for reports — GlabIT-controlled application endpoints and domains: the web application served at https://glabit.com/ (and www.glabit.com), including its pages, static files, security.txt and the contact endpoint /api/contact; the development preview at https://prod.glabit-dev.com/ (same application, preview configuration). Other GlabIT-controlled endpoints or domains will be listed here explicitly before they are in scope.
• Eligible for reports — GlabIT-owned infrastructure: only the server instances and configuration that GlabIT itself administers for those endpoints (the web server, the contact relay and their operating-system configuration), at the application and service layer reachable through the listed domains.
• Not eligible — hosting-provider networks, control planes and accounts: the data-centre provider’s network, hypervisor, management consoles, APIs, DNS or account systems are not GlabIT-controlled and are not in scope merely because they serve the website. Testing them requires the provider’s own authorisation under its own policy.
• Not eligible — client systems: systems belonging to our clients are never in scope of this process. Do not test them on our account; if you believe a client system is affected, tell us and we may pass the information on to the client under our own obligations.
• Not eligible — other third-party systems: any other service, supplier, registrar, certificate authority, email provider or upstream network.
• Receiving a report never authorises testing of any system — eligible or not — and this process does not operate or authorise remediation of client systems.

How to report

• Email info@glabit.com with the subject line starting SECURITY:. This is today our only reporting channel: we do not currently operate a dedicated security mailbox, a published encryption key or an encrypted upload service, and we do not claim one here. If a dedicated monitored mailbox and a tested secure-transfer method are put in place, this page and security.txt will say so.
• Keep the first message minimal: the affected system or URL, the type of issue, how you found it in one or two sentences, and how we can reach you. That is enough for us to acknowledge and agree the next step.
• Useful in a first report: the affected host, the request or steps at a high level, the impact you believe it has, and whether the issue is already public.
• Do not send through ordinary email or the contact form: working exploits, credentials, tokens, private keys, dumps, screenshots or files containing personal or client data, or any evidence that would itself be sensitive if intercepted. If more detail is needed we will agree, case by case and if we can provide one at that time, a secure way to receive it (for example an encrypted exchange using keys agreed by email, or a transfer method we set up for the case) before you send it; until that is agreed, keep sensitive detail out of your messages.

Rules

• No exploitation at all — this page authorises none; if you believe you have seen an issue in ordinary use, report what you observed and stop. In particular no persistence, no data exfiltration, no modification or destruction of data, no denial of service, no social engineering of our staff or clients, no physical activity, and no testing of client or third-party systems.
• If you encounter personal data, client data or anything you did not expect, stop, do not copy or store it, and tell us what you saw.
• Act in good faith and give us a reasonable opportunity to fix the issue before any disclosure.

What you can expect from us

• We aim to acknowledge a report promptly and to keep you informed of the status. This is an aim, not a service-level agreement; we do not currently publish or guarantee a response time.
• We limit access to your report and your identity to the people who need it to investigate, remediate, obtain professional advice or meet legal duties: authorised GlabIT personnel; where necessary an affected client, the relevant processor or service provider, our legal or security advisers, an insurer, a competent authority, or another recipient where disclosure is required by law — on a need-to-know basis and subject to appropriate confidentiality and applicable law. We do not publish your name without your permission unless disclosure is required by law.
• Records and retention: we keep the report, our correspondence with you and the evidence of how the issue was handled according to objective criteria: while the issue is under active investigation or remediation; afterwards as evidence of handling; for the period in which legal claims can be established, exercised or defended; where a legal or regulatory duty requires it; and while a legal hold applies. Sensitive payloads that are no longer needed — exploit detail, credentials, personal data encountered — are deleted earlier than the case record. No fixed period is stated.
• Disclosure timing is coordinated with you case by case, taking into account fix complexity and the risk to others.

What we do not offer

• No bug bounty or payment.
• No legal immunity, safe harbour or promise of non-enforcement — we cannot waive the rights of third parties or the application of the law. Reports made in good faith and within the rules above are welcome and are how we would prefer to learn about issues.
• No authorisation to test any system is granted by this policy. Nothing on this page, in security.txt or in our handling of a report authorises probing, scanning or testing of any system, whether or not it is listed as eligible for reports; testing requires GlabIT’s prior written authorisation.

The machine-readable security.txt reflects the same contact and links to this page as its policy. security.txt lists no preferred languages (RFC 9116 then defaults to English); we will list a language there only once we have confirmed who monitors the reporting address and can read, answer and escalate reports in that language.