Responsible Disclosure Policy.

Scope

This policy covers vulnerabilities in the pentesto.se website itself — not third-party services we link to, and not customer systems we test on someone else's behalf. We only accept reports about our own infrastructure.

What's okay to test

Please report vulnerabilities you find through passive observation or testing that does not disrupt other visitors or our operations: misconfiguration, information disclosure, authentication or authorisation flaws and the like.

• Avoid anything that could affect other visitors or our availability — no denial-of-service (DoS/DDoS), no bulk automated scanning.
• Do not access, modify or delete data that is not your own. If you can demonstrate a vulnerability with a minimal test case, do that instead.
• Do not attempt social engineering (phishing, vishing) against our staff.
• Do not otherwise break the law — this is not a licence to do anything you like.

Safe harbour

Stay within this policy and we treat your testing as authorised under our terms of service, and will not pursue legal action against you for it. That is conditional on good faith: discover, report, stop testing once you've found something — not keep digging after a vulnerability is confirmed.

How to report

Email hej@pentesto.se with what you found, how we can reproduce it, and what impact you believe it has. Feel free to send an encrypted report if the content is sensitive — reach out and we'll arrange it.

What to expect

We acknowledge receipt within five business days, and follow up with our assessment and a remediation timeline as soon as we can. We keep you updated until the issue is closed.

Reward

We do not run a bug bounty programme and do not pay for reports. We're happy to credit you publicly if you'd like that, and otherwise keep you anonymous.