🔒
Security

Security & Responsible Disclosure

PSIP is committed to keeping our platform secure for all users. We welcome reports from security researchers who identify vulnerabilities in good faith and will work with you to resolve them quickly.

Found a vulnerability?

Email us at [email protected]. We will acknowledge your report within 2 business days and aim to provide a full response within 10 business days.

Report a vulnerability

Scope

✓ In scope

  • ▸psip.co.uk and all subdomains
  • ▸The PSIP web application and API
  • ▸Authentication and session management
  • ▸Data isolation between user accounts

✗ Out of scope

  • ▸Denial of service attacks
  • ▸Social engineering of PSIP staff
  • ▸Physical security
  • ▸Third-party services (Supabase, Resend — report these to those providers directly)

How to report

1

Email [email protected]

Send your report to our dedicated security address. Please do not report vulnerabilities through public GitHub issues, social media, or other public channels.

2

Include the key details

A clear description of the issue, step-by-step instructions to reproduce it, an assessment of the potential impact, and your contact details for follow-up.

3

Allow us time to respond

We will acknowledge your report within 2 business days. We aim to provide a full response — including our assessment and a fix timeline — within 10 business days.

Our commitments to researchers

⚖️

No legal action for good faith research

We will not pursue legal action against researchers who discover and report vulnerabilities responsibly, in accordance with this policy.

📬

We will keep you informed

We will update you as we investigate and resolve the issue. We aim to be transparent about our timelines and findings.

🏅

Credit where it is due

We will acknowledge researchers in our release notes for confirmed vulnerabilities, where the researcher chooses to be named.

What we ask of you

  • ▸Do not access, modify, or delete other users' data
  • ▸Do not disrupt the service or degrade its performance for other users
  • ▸Report to us before making any public disclosure, and allow reasonable time for a fix
  • ▸Act in good faith — test only against your own account where possible

Security contact

For all security-related reports and enquiries:

[email protected]

Response within 2 business days · Full response within 10 business days