Security policy

Scope

We accept security reports concerning HibeRota's public web pages, administrator access surface and data-processing flows. Reports must be prepared only against your own test account or publicly available content, without disrupting the service.

How to report

Send your findings to mailto:[email protected]. Include an impact summary, reproduction steps, the relevant URL and screenshots where available.

Good-faith research rules

• Do not attempt to delete, alter or export data.
• Do not conduct DDoS, load testing, social engineering, physical attacks or persistence attempts.
• Do not try to view or share another person's personal data.
• Use the least data and lowest-risk method needed to demonstrate a finding's impact.

Response process

Reports are prioritised, verified and handled according to their impact. For critical findings, public technical details are not shared until temporary protections, remediation and verification are complete.

Confidentiality and legal framework

HibeRota keeps good-faith reports confidential. This page is not an authorisation to test security; applicable laws, service terms and third-party system rules remain in force.