Responsible disclosure

If you believe you have found a security issue in a Prismelo-operated system, we want to hear about it.

Scope

In scope

• Web properties served on prismelo.tech
• Services and APIs operated directly by Prismelo

Out of scope

• Third-party services and platforms we use
• Systems belonging to companies in the group that operate their own properties — report those directly to the relevant company
• Findings that require physical access, social engineering or insider access
• Denial-of-service testing, load testing and automated scanning that degrades service
• Reports generated solely by a scanner without a demonstrated impact

How to report

Email hello@prismelo.tech with the subject line SECURITY DISCLOSURE. Include:

1. The affected URL or component.
2. A description of the issue and its potential impact.
3. Reproduction steps, with requests or screenshots where useful.
4. Whether the issue has been disclosed elsewhere.

If you need to send evidence over an encrypted channel, say so in a first message without attachments and we will arrange a method.

What happens next

• We acknowledge receipt and confirm whether the report is in scope.
• We investigate and, where confirmed, plan remediation.
• We keep you informed of meaningful progress.
• With your agreement, we credit the reporter once the issue is resolved.

Prismelo does not currently operate a paid bounty programme. Reports are nonetheless taken seriously and handled as a priority.

Safe harbour

Where a report is made in good faith, within the scope above, and without privacy violations or service disruption, Prismelo will not pursue legal action in relation to the research. This does not authorize testing of systems outside the stated scope.

Timing

Please allow reasonable time for remediation before public disclosure. We will agree a disclosure date with you and will not ask for indefinite silence — if remediation is complex, we will tell you what is happening and when to expect a fix.