BugShield security research and reporting policy
Last updated: 14 October 2026

Scope

This policy covers bugshield.co.uk, all of its subdomains, and all other
BugShield websites, domains, applications, APIs, plugins, products, services,
accounts, networks, infrastructure and company-related systems or assets,
including those hosted or operated on our behalf by third parties.

No permission to test

BugShield does not authorise unsolicited penetration testing, security testing,
vulnerability scanning, automated probing, exploitation, social engineering,
denial-of-service testing or any other security research against these assets.
Do not carry out these activities against BugShield or its systems.

Publishing security.txt, providing a reporting address, receiving a report or
responding to it does not grant permission to test or continue testing. Public
access to a website, an account or a service does not grant that permission.
This policy also grants no permission to test customer or third-party systems
connected to our services.

No bounties or payment

BugShield does not operate a bug bounty programme. We do not pay bounties,
rewards, fees or other compensation for security research, vulnerability
reports or unsolicited testing. Sending a report does not create an
entitlement to payment.

Reporting an issue encountered without testing

If you encounter a suspected security issue during normal use, report what
you have already observed to info@bugshield.co.uk. Include the affected URL
or product and a brief description. Do not perform further tests to confirm
the issue, access other people's data, or include passwords, credentials,
personal data or other sensitive information in your message.

The reporting address is provided for notification only. Reporting an issue
does not change the testing restrictions or payment policy above.