Vulnerability disclosure

Last updated: November 2026

Scope

This policy covers risecontrol.co.uk and www.risecontrol.co.uk only. Client systems, third-party services and other infrastructure are not in scope. Please contact us before testing anything you are unsure about.

How to report

Email info@risecontrol.co.uk with the affected URL, a clear description, minimal steps to reproduce and the potential impact. Do not include personal data, passwords or confidential material; ask us for a secure way to send evidence if needed. We aim to reply within 5 working days.

Good-faith safe harbour

For good-faith research that follows this policy, we will not take legal action or ask for prosecution. This applies only to systems we control and cannot bind third parties. Please stop once you have sufficient evidence, report privately, and give us reasonable time to fix the issue before any disclosure. We do not offer rewards.

Testing limits

No denial-of-service testing, high-volume or automated scanning, spam through the form, social engineering, phishing or physical attacks. Do not access, change, delete or keep other people’s data, or create persistent access. If you encounter data by accident, please stop and inform us without copying it.