1. Our commitment
Paulioskos values responsible security research. If you believe you have found a vulnerability in a Paulioskos-managed public service, report it privately so that it can be investigated, risk reduced and any disclosure coordinated.
2. In-scope assets
https://paulioskos.com
https://www.paulioskos.com
Public website pages, static assets and Trust Centre content delivered through those hostnames.
The public enquiry form and associated browser-facing submission endpoint.
Security and configuration issues directly affecting Paulioskos-controlled public DNS or website delivery.
The normal administrator sign-in boundary only for passive observation or minimal non-destructive testing that does not attempt to obtain access.
/.well-known/security.txt once published.
No source-code repository is currently authorised as a public testing target. A repository becomes in scope only if it is publicly accessible and expressly named in this policy or security.txt.
3. Out of scope
notes.paulioskos.com, finance.paulioskos.com and other private or access-controlled Paulioskos services;
home-lab systems, internal management services, staging systems and hosting-origin addresses unless expressly listed;
customer, prospective-customer, employer, partner, consultant and supplier systems;
Microsoft, Cloudflare, GitHub, SSD Nodes, LinkedIn, Veeam and other third-party infrastructure;
any domain, subdomain, IP address, repository or service not expressly listed as in scope.
A suspected issue affecting an out-of-scope service may still be reported privately. Reporting it does not authorise further testing.
4. Prohibited activity
Social engineering, phishing, impersonation, pretexting or credential solicitation.
Physical security testing or interference with people, premises or devices.
Denial of service, traffic flooding, resource exhaustion or testing likely to impair availability.
Destructive testing, alteration, corruption or deletion of information.
Malware deployment, persistence, lateral movement or pivoting into another system.
Credential guessing, use of credentials that are not your own, session theft or bypass of authentication controls.
Accessing, enumerating, downloading, copying or retaining more information than the minimum needed to demonstrate the issue.
High-volume, indiscriminate or disruptive automated scanning.
Direct testing of the hosting origin or attempts to bypass Cloudflare.
Submission of real personal information, credentials or harmful content as test data.
Public disclosure before Paulioskos has had a reasonable opportunity to investigate, remediate and coordinate disclosure.
5. Good-faith research expectations
Use the minimum testing needed to confirm the suspected vulnerability and likely impact.
Avoid privacy violations, data destruction, service disruption and degradation of user experience.
Do not exploit the issue beyond demonstrating its existence.
Use clearly synthetic test data where a form submission is necessary.
Report promptly and keep material details confidential while remediation is coordinated.
Stop and ask before performing an action where scope or permission is uncertain.
6. Personal or confidential data
If you encounter personal, confidential, client, authentication or commercially sensitive information, stop testing immediately. Do not open additional records, download, copy, screenshot, modify, delete, share or retain the information. Record only the minimum technical detail needed to explain the exposure and report it immediately to [email protected].
The discovery of exposed information does not grant permission to enumerate records or demonstrate access using multiple examples. Any unavoidable temporary copy must be secured and deleted as soon as Paulioskos confirms it may be removed.
7. What to include in a report
Affected URL, hostname, endpoint or component.
A concise description of the suspected vulnerability and likely impact.
Reproduction steps, request/response details or a minimal proof of concept.
Date and time of testing, including time zone.
Any account type or permission level used.
Whether any personal or confidential data was encountered and confirmation that it was not retained.
Your preferred contact details and whether you would like attribution after coordinated disclosure.
8. How to report
Email [email protected] with a subject such as “Security vulnerability report - affected service”. Do not include passwords, private keys, database extracts or personal information in ordinary unencrypted email. Request a secure, restricted and time-limited transfer route before sending sensitive supporting material.
No PGP key is published at the initial public launch. An encryption key may be added later once ownership, backup, expiry and revocation procedures are established.
9. Response targets
| Stage | Target |
|---|---|
| Acknowledgement | Within three business days where usable contact information and sufficient detail are provided. |
| Initial triage | Normally within ten business days. |
| Urgent risk | Reports indicating active exploitation or immediate risk to personal information, authentication or service integrity are prioritised as soon as reasonably practicable. |
| Material finding updates | At least every ten business days while a confirmed high-impact issue remains active. |
| Other confirmed findings | When there is a material change and, where practical, no more than twenty business days between updates. |
| Remediation and disclosure | Determined by severity, technical complexity, supplier dependencies, user risk and the availability of a safe fix. |
These are service targets, not contractual SLAs or guarantees. Paulioskos may need more information before it can reproduce or classify a report.
10. Coordinated disclosure, recognition and rewards
Please allow reasonable time for investigation and remediation before publishing details. Paulioskos will discuss a proportionate disclosure date for confirmed issues. There is no automatic 30-day, 90-day or other fixed deadline.
A reporter may be acknowledged publicly after remediation, but only with express permission and agreed wording. Paulioskos does not currently operate a bug-bounty programme and does not promise payment, gifts, employment, services or another reward.
11. Good-faith position
Where research concerns an expressly in-scope asset, is conducted in good faith, follows this policy, uses only the minimum necessary testing and avoids harm, Paulioskos does not intend to initiate legal action solely because of that compliant research.
This position does not authorise unlawful activity, bind third parties, permit testing of third-party systems or protect reckless, dishonest, disruptive or out-of-scope conduct. If uncertain, stop testing and contact Paulioskos.
12. security.txt
Paulioskos will publish security.txt at the standard /.well-known/security.txt location on the root and www hostnames. It will identify [email protected], link to this policy, state English as the preferred language, provide a canonical location and contain an expiry date reviewed before it becomes stale.
Contact
| Route | Details |
|---|---|
| Security reports | [email protected] |
| Website | https://www.paulioskos.com |
| Policy location | Paulioskos Trust Centre |
Reference framework
These references explain the legal and good-practice framework used when preparing this document. They do not represent certification, accreditation, endorsement or legal advice.