Vulnerability disclosure policy

1. Reporting a vulnerability

If you believe you have found a security vulnerability in Hamsterra, email security@hamsterra.com with “Security report” in the subject line. Please write in English. Do not use the public help form for security reports.

Hamsterra is operated by Cat and box LLP, a limited liability partnership registered in England and Wales, number OC458074. A machine-readable contact is published at /.well-known/security.txt.

2. What you may test

You may test Hamsterra only with accounts you own, guest applications you submit with your own email address, and books, campaigns and files you control. This permission does not cover other people's accounts, applications, books or personalised copies, or third-party services we use (such as Cloudflare, Amazon Web Services or Google).

• Do not run denial-of-service tests or anything that degrades availability for others.
• Do not use social engineering, phishing or impersonation of staff, authors or readers.
• Do not modify, delete or corrupt data that is not yours.
• Do not send bulk or repeated emails, sign-in codes, invitations or support messages.
• Do not access, download or keep other people's personal data, book files or advance review copies.
• Do not try to bypass or automate the security check on account, sign-in code and application forms.

If you come across another person's data, stop at once, do not look further, and tell us in your report without including that data.

3. What to include

• The affected page, URL or feature.
• Steps to reproduce using your own accounts and test data, including any prerequisites.
• What you expected, what happened and the practical security impact.
• A minimal proof of concept, or relevant requests, responses and screenshots with sensitive values removed.
• How we can contact you with follow-up questions.

Do not send passwords, session cookies, access links or other people's personal data.

4. Coordinated disclosure

Please report privately and give us reasonable time to investigate and fix the issue before anything is published. We will acknowledge your report within 5 working days, aim to tell you our initial assessment within 10 working days, keep you informed while we work on a fix and tell you when the issue is resolved. We will agree with you when details may be published, and we will credit you if you wish.

5. Good-faith research

If you act in good faith and follow this policy, we will treat your research as authorised, and we will not take legal action against you or report you to law enforcement for it, including under the Computer Misuse Act 1990. If a third party takes legal action against you for research that followed this policy, we will make it known that you acted in line with it.

This does not authorise testing of third-party services, does not apply if you demand payment or other benefit in return for a report or for not publishing it, and cannot override the law. If you are unsure whether something is allowed, ask us first.

6. No bug bounty

Hamsterra does not run a bug bounty programme and does not pay rewards for vulnerability reports. Sending a report does not create any right to payment or other compensation.