Report a vulnerability

If you believe you have found a security vulnerability in a W5 Technologies website or system, we want to hear about it. We will not take legal action against good-faith research that follows this policy.

How to report

Email security@w5technologies.com with:

• the affected URL or system
• a description of the issue and its impact
• steps to reproduce it, or a proof of concept
• your name or handle, if you would like credit

Do not send vulnerability details through the contact form. Our machine-readable contact details are in security.txt.

What we commit to

• We acknowledge your report within two business days.
• We give you an assessment and an expected fix date within ten business days.
• We tell you when it is fixed, and credit you publicly if you want us to.

Rules for researchers

• Test only systems owned by W5 Technologies. Client systems are out of scope, even where we built them. Report those to the client directly.
• Do not access, change or delete data that is not yours. Stop and report as soon as you have proof.
• Do not run denial-of-service tests, social engineering or physical attacks.
• Give us reasonable time to fix the issue before telling anyone else.

We do not currently run a paid bug bounty.