Home/Responsible disclosure
Security
Responsible
disclosure
A security firm that cannot take a report is not a security firm. If you believe you have found a vulnerability in this website or in a Sicarii 613 system, we want to hear it — and we will treat you as a researcher, not an adversary.
Scope
This policy covers:
- sicarii613.com and any subdomain we operate.
- Web applications and APIs we publish under our own domain.
- Any Sicarii 613 client portal or intake system.
It does not authorise testing of third-party services we link to, client-owned systems we operate under contract (report those to the client, or to us and we will route them), or any system where you do not have permission.
How to report
Email security@sicarii613.com with:
- A description of the issue and its potential impact.
- Steps to reproduce, or a proof-of-concept.
- The URL, endpoint or component affected.
- How you would like to be credited, or a request to remain anonymous.
If you need to send something sensitive, say so in a first message without attachments and we will arrange an encrypted channel.
What we commit to
- Acknowledge your report within two business days.
- Keep you informed of our assessment and remediation timeline.
- Not pursue legal action for good-faith research conducted within this policy.
- Credit you publicly, with your consent, once the issue is resolved.
- Tell you honestly if we believe the issue is out of scope or already known.
What we ask
- Do not access, modify or exfiltrate data that is not yours.
- Do not degrade service, run automated scanners at volume, or test against production in a way that could affect other users.
- Do not disclose the issue publicly before we have had a reasonable opportunity to fix it. Ninety days is our default; we will usually be faster and will agree a date with you.
- Stop and contact us immediately if you encounter client data or personal information.
Out of scope
- Denial-of-service testing and volumetric attacks.
- Social engineering of our staff, clients or suppliers.
- Physical attacks on our premises or those of our clients.
- Reports generated solely by automated scanners without a demonstrated impact.
- Missing security headers or cookie flags reported without a concrete exploit path.
- Third-party services and software we do not maintain.
Recognition
We do not operate a paid bounty programme. We do credit researchers who report valid issues, with permission, and we will provide a letter of acknowledgement on request for your own records.
Report
Found something?
Tell us before anyone else.
One email is enough. Include what you saw and how to reproduce it.