Vulnerability disclosure policy

If you think you have found a security vulnerability in securebydesignlabs.com or in one of the tools we publish here, please tell us. This page explains how to report it and what you can expect from us.

What to include

• The page, tool or URL affected.
• What the issue is and what an attacker could do with it.
• How you came across it and how we can see it for ourselves, with screenshots if they help.
• How you would like to be contacted, and whether you would like to be credited.

Scope

This policy covers securebydesignlabs.com and the free tools hosted on it.

It does not cover the third-party services we use, such as our hosting, payment and email providers. Please report issues in those services to the provider directly.

The following are out of scope:

• Denial of service, or anything that degrades the site for other visitors.
• Social engineering, phishing or physical attacks against us or our customers.
• Automated scanner output without a demonstrated, realistic impact.
• Spam, or creating large numbers of accounts, orders or form submissions.

Handling what you found

• If you have come across personal data, please do not access, change or keep any more of it than you already have.
• Do not include other people’s personal data in your report. Tell us what kind of data it was rather than sending it.
• Keep the details confidential until the issue is fixed or we have agreed a disclosure date with you.

What you can expect from us

• We aim to acknowledge your report within five working days.
• We will let you know whether we can reproduce the issue, and keep you updated while we work on a fix.
• We would like to agree a disclosure date with you. If we have not, we ask that you allow 90 days from your report before publishing details.
• With your permission, we will credit you when the issue is fixed. We do not currently offer payment for reports.

Last updated 10 October 2026.