Vulnerability disclosure
Report a vulnerability in our systems
Reports go to hello@principlebreach.com. The machine-readable version of this policy is at /.well-known/security.txt.
0x01Scope
In scope
Systems this company owns and can authorise testing against.
In scope
principlebreach.com and its subdomains
The website, the content platform, the contact and booking forms, the calculators, and the assessment flow.
In scope
Our API and admin interface
Endpoints under /api, the content API, and the admin panel. Authentication, authorisation, injection, and access-control bugs are all in scope.
In scope
Our public repositories
Code we publish under github.com/principlebreach. If a repository carries its own security policy, follow that one first.
0x02Exclusions
Not in scope
Anything below will be closed as out of scope.
Client systems
Anything we have tested under contract belongs to the client, not to us. Report it to them under their policy.
Third-party services we use
Our analytics, mail, hosting, registrar, and calendar providers each run their own programme. Report to the vendor.
Findings with no security impact
Missing hardening headers, TLS scanner warnings, version or banner disclosure, self-XSS, clickjacking with no state change, or a spoofed email no receiving server accepts.
Denial of service
Volumetric testing, resource exhaustion, and rate-limit stress against production. Describe the reasoning instead of demonstrating it.
Social engineering
Phishing, pretexting, and physical or social attacks against staff. No one here has consented to being a target.
Scanner output with no exploit
A raw scanner report is not a submission. Confirm the issue is exploitable before you send it.
0x03Reporting
How to report
Email is the only channel. There is no form and no portal. One issue per email.
We do not run a bug bounty and offer no payment for reports. You get a reply, a severity assessment, and public credit if you want it.
Send to
hello@principlebreach.comEncrypt anything that contains a working exploit, credentials, or data you reached. The key below is fetchable from /pgp-key.txt.
Include in your report
- The URL, endpoint, or repository, and the exact request that triggers the issue.
- Numbered steps to reproduce, from an unauthenticated state or an account you created yourself.
- The impact: what an attacker could reach, stated separately from what you actually did.
- Any accounts, test data, or artefacts you created, so they can be cleaned up.
PGP key C3DC 3424 CBE3 0B94 59AF FBB8 9B06 8774 AE24 3BB4
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQGNBGlSaq0BDAC//KAoxrDKJw493eSCt4T4rFTroW3grFI0Vg9VFkGRH5Xlpgr8
WHEGdt8MnsNNMe70KoAVgj/YVzrKzzfcoIQRlosYO1OwPqvVy1vlOUtDb1M/q867
QExwBcRfRqvoQez/SYSN7KWaGVhNBhK7YUjwutUOwv6vMa9UIlm4CBbeNrEvAvI7
ddKHjksurcYqv2UXGHfXJk48GFtLwbNybAKcDtEl1tmXNHPhHL4BVRYoSeiDHlV4
vU0ybk10sAs41rIe2FYoP8czvdQUZfOp6cYqKkuNpwIuAaKfxSeCK1c4B4Ktjp1A
CtMGfO3z19yXuky6dBLKWUoOdAwS5lQaC2scbNOaaQ4D24HeOuSIOMjUBubtkQf/
TmkU5gtiCVN8zewICY0LHKyIdVW6PIA2YsLp+lxNLNYYnDnX1FvGhv1q8/F5941R
INkrW4DNfohYt9sGeppQSQoEhJ64NvdkCQu16bRqFd+jyJiNo96Ft+9kybkL5NL0
tt1RwULsn687CHUAEQEAAbRQUHJpbmNpcGxlIEJyZWFjaCAoRmlyc3QgcHJpbmNp
cGxlcywgRmlyc3QgdG8gYnJlYWNoKSA8aGVsbG9AcHJpbmNpcGxlYnJlYWNoLmNv
bT6JAdcEEwEIAEEWIQTD3DQky+MLlFmv+7ibBod0riQ7tAUCaVJqrQIbAwUJBaOa
gAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIXgAAKCRCbBod0riQ7tPTtDACbYV/3
JAKshX9+ixdDOK2XyWu7T6w9Gjx8vtVd9AeiNSBWC1Et3oOZt6w+HkL3aKwgXbbj
U+H3KT5DCD4KL5aZtJnbEHbzHgHNv0gXMasPIjlHFCtNcdW8V3BQGR1XjYVxjTyQ
c7B8xFmVWB/wlD48BH/OnWrTYa3ZlrHE8iZvQFe4hqRGoRlSK1Bihx4YUrsj1mWA
T7hJu439wD63d2jvSLnC79vi2s4depmJt3nabnBlfxmwPEeLYIVA+kIMhf3RF+P4
5AAbl6yDiysGSEnynSPWYr/Wv5YKr5lEzeZEXDZ56eSwQkM/7ijuzb+BTR7Pw64l
EWsKq1F1a3o7+ggFl+hOw3JB/mJWh8qD0qeEQFcl628GLeK+ftgmxumUM5ylQ21O
f6EQprdghNOZNFsxGVSFA/JomhUxv96V8ApwQ3PDlW4v51UAwEMub7eCETHilscd
zjHJldnSC9/MMbEQ3RWcvV6PQ8iPl54qOBOqPCDQ4oztRSpfTSaKxuYxBba5AY0E
aVJqrQEMAL6tiJTJbKJ0tPxDt+4Erfaz3Qt6hgI9qMUNvc6MGvPgyMe/ObBSPW+3
4Y8EE46fiB8PIwCoq0/4cVtteW3b64XmhVwE5l0FJLs8mofhAHbgba/j9E+nQ2+L
mlk/kd4Z1EErTx8rIGZzXQueXgw0kyu8g301PxNKrYT8o5ghUoZebbjIDMZEDOXV
+1s/NEGHbPazWiXWB5sZaxIaP1DcRDjSx3+YN0cKIDM2JoGNcUIxnJC/e0S1zZ4f
7EqsZAjJaIY3DUUcfYB7RMbEM2e36GSQy3rt4HsLX9PTFUtx1sEr164sIiOhMBUa
VF8ax2eGyhMkjAx2i7c6VHPtwiHm6IkN1bv6nTVcjFnU+3gutkvia7bktGIIn/Iv
J2RiGg/ViESxUFzhQCOfZJ7IHlmg1iF6HIxt0cWij9qr/qpPBHLNV22iIySRou9l
HMveyALRb6+/wJdDSICUHOzDmxW0BBFxHLNnDQr+NUwtnXD59Npm9+4kWaNezLot
uBc0KKvD/wARAQABiQG8BBgBCAAmFiEEw9w0JMvjC5RZr/u4mwaHdK4kO7QFAmlS
aq0CGwwFCQWjmoAACgkQmwaHdK4kO7TIgwwAkz7pg2iUGMEy7EbZpV7WD5TifkNE
jh+TZQcIWA+G0I4PeVjnztKLNXYS8BOi0mWSQ7Xe8RVM+JkllJFS0IwZ4aH2H5+X
oDQv6pvk32ldaqSa77KE0xyTLQFK6Neis4ulZLlhG8p2dgRGvVXN7TkibvBxiSen
YrZ5szUhD9/PM3al+zYH+uEug3F02CfxdctcK8JRjlkmcfowqXYQcJUV1C75wlN5
EozLAeHCwzmu2Liwrydmz8gdFK7i/wlkF8CWqpyLD/b42Ob7iZIPYAuPDljbU7/o
txgQXV/cTp84KoTbieKdo2uoclJ/KziFE/sY7gMAOKoZ0337xbVV1gibGhI1cVLe
vQtJkhlD/JDIMIia2dpsjUjU+KsDBf3W1O/4IJp/Xi+ZJcduFg+a/oS83vEhTtqG
zZvAwt/ILQn+pv3vpP/rVMoLcyqMym2PZTdzqHzWQwgkiQOIo/cG9KXB2GX6qPKT
Bx9Wwxb7xhRpD5Uz0jFQzkFx2qw9WMJC5vgJ
=ghmL
-----END PGP PUBLIC KEY BLOCK-----
0x04Response
What happens next
Acknowledgement within 7 working days is the one time we commit to.
01
Report
Email the report, encrypted to the key below if it contains anything sensitive. One issue per email.
You
02
Acknowledge
You get a reply confirming receipt and whether the issue is in scope.
Within 7 working days
03
Reproduce and assess
We reproduce the issue and assign a severity. If we cannot reproduce it, we tell you what we tried.
Us
04
Fix and disclose
We tell you when a fix ships and agree a disclosure date. Absent any other agreement, the default is 90 days from your first report.
Both
0x05Rules
Rules of engagement
Staying inside these rules is what the safe harbour below is conditioned on.
- Test only against in-scope assets, and only with accounts you created yourself.
- Stop at proof. Show that access is possible and go no further. Do not read, copy, alter, or keep anyone else's data.
- Do not degrade the service. No denial of service, no destructive payloads, no traffic heavy enough to affect availability.
- Do not pivot. Access to one in-scope system is not authorisation to reach anything behind it.
- Delete anything you kept, and any accounts or content you created, once the report is closed.
- Keep the finding private until the agreed disclosure date.
0x06Safe harbour
Safe harbour
Good-faith research inside the scope and rules above is authorised as far as this company is concerned.
- We will not pursue legal action or refer you to law enforcement for good-faith research within this policy.
- Accidentally stepping out of scope does not void this, provided you stop as soon as you notice, tell us, and do not use or keep what you reached.
- We can only authorise testing against our own systems. Nothing here covers a client's, a provider's, or any third party's assets.
- This policy does not override criminal law in your jurisdiction or in India, where the company is registered.