# Responsible Vulnerability Disclosure

> Canonical: https://www.realcode.co.uk/vulnerability-disclosure/
> Format: Markdown version of this page for AI agents and LLM consumption.

_Found a security issue in our site or systems? Here’s how to tell us safely._

_Last updated: 2026-09-30_

---

_Last updated: 30 September 2026 — reviewed annually._

## Reporting a vulnerability

We welcome reports from independent security researchers. If you believe you have found a vulnerability in **realcode.co.uk**, our associated public web assets, or client demonstration systems we operate, please email [contact@realcode.co.uk](mailto:contact@realcode.co.uk?subject=Security%20disclosure) with the subject line **“Security disclosure”**.

A machine-readable version of this policy is published in the standard location at [/.well-known/security.txt](/.well-known/security.txt).

## What to include

-   A description of the issue and the affected URL, asset or system.
-   Steps to reproduce, including any request/response evidence you gathered.
-   The potential impact, as you understand it.
-   Your contact details and, if you wish, a name we can credit.

## In scope

-   This website and the public infrastructure we operate for it.
-   Client demonstration, staging or prototype systems we host under our control.

Third-party services we use but do not operate (for example our email or hosting providers) should be reported to those providers directly.

## Safe harbour

If you act in good faith and within the rules below, we will not pursue or support legal action against you in relation to your research:

-   Do not access, modify or destroy data that is not yours — demonstrate issues with the minimum necessary interaction.
-   Do not disrupt our services or degrade availability (no denial-of-service testing).
-   Do not use social engineering, phishing or physical intrusion.
-   Keep the details confidential until we have had a reasonable opportunity to investigate and remediate.

## What you can expect

-   We will acknowledge your report within five working days.
-   We will investigate, and where we confirm an issue we will remediate it in a timeframe proportionate to its severity.
-   With your permission we are happy to credit you once the issue is resolved. We are a small business and do not operate a paid bug-bounty programme.

Thank you for helping keep us — and our clients — secure.