Responsible Disclosure Policy

Reporting

Send a written report to security@sterlingwick.com. Include a description of the issue, the affected system or page and, where available, steps to reproduce it.

Researcher expectations

Act in good faith. Do not access more data than necessary, disrupt services, or disclose an issue publicly before a reasonable resolution period.

Company response

Sterlingwick will acknowledge credible reports where reasonably possible and assess them in a proportionate manner.

The company does not operate a paid vulnerability reward programme.

Scope

This policy applies to Sterlingwick-operated digital properties. Third-party services should be reported to their providers.