Security
Responsible Disclosure
If you believe you have found a security vulnerability in a SIPRONE-owned website or service, please report it privately so we can assess it.
Last updated 1 October 2026
Scope
This policy applies to internet-facing websites, domains and services that are owned and operated by SIPRONE. It does not authorise testing of customer environments, partner systems, third-party platforms, physical locations, people, or infrastructure that SIPRONE does not own or has not explicitly authorised for testing.
How to report
Email info@siprone.com with the subject Responsible Disclosure. Include the affected asset or URL, a clear description, reproducible steps, potential impact and the minimum evidence needed for us to verify the issue. Please do not include personal data or unrelated confidential information.
Research we ask you to avoid
- denial-of-service, load testing or actions that impair availability;
- destructive testing, deleting or changing data, or installing persistence;
- accessing, copying or exfiltrating data beyond the minimum needed to demonstrate an issue;
- social engineering, phishing, credential attacks or physical-security testing;
- high-volume automated scanning that may disrupt systems;
- testing customer, partner or supplier environments without their explicit authorisation.
What to expect
We aim to acknowledge useful reports promptly, validate the issue, determine the affected scope and coordinate remediation where appropriate. Timing depends on severity, complexity, third-party dependencies and the evidence provided. We may ask for additional information.
Good-faith research
We ask researchers to act in good faith, minimise impact, respect privacy and stop when sensitive data becomes accessible. This policy is not a bug-bounty programme, does not promise a reward, and does not grant legal immunity or permission to test systems outside the scope above.
Security.txt
Our machine-readable disclosure contact is available at /.well-known/security.txt.