Penthertz is a security company, and we welcome reports of security issues in our own websites and services. This policy explains what is in scope and how to report. It covers Penthertz’s own assets only; it is not authorisation to test any client or third-party system.
Scope
In scope: penthertz.com and the services Penthertz operates on its own domains. Out of scope: third-party services and platforms we use but do not control, social engineering of our staff or customers, physical attacks, denial of service, and anything that would degrade our service or access other people’s data.
How to report
Email [email protected]. For sensitive details, encrypt your message with our PGP key, linked from our security.txt. Please include what you found, where, the steps to reproduce it, and the impact. A machine-readable copy of this contact is published at /.well-known/security.txt.
Good-faith safe harbour
If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you for your research. Acting in good faith means staying within scope; not accessing, modifying or deleting data that is not yours; not degrading our services; stopping as soon as you have a proof of concept; and giving us a reasonable time to fix the issue before disclosing it publicly, which we coordinate with you.
What to expect
We aim to acknowledge your report quickly and to keep you informed while we investigate and fix it. We are happy to credit you once the issue is resolved, if you wish. We do not run a paid bug-bounty programme, but we value and recognise responsible reports.