Report a vulnerability

How to report

If you believe you've found a security vulnerability in our software or this website, email pete@purchon-innovation-technology.co.uk with the subject "Security disclosure". A machine-readable contact is also published at /.well-known/security.txt.

What to include

• What you found and where;
• Clear steps to reproduce it;
• The potential impact as you see it;
• Any proof-of-concept — please keep it minimal and non-destructive.

Our commitment

• We'll acknowledge your report as soon as we reasonably can;
• We'll investigate and keep you updated on progress;
• We'll credit you if you'd like, once any issue is resolved.

Please do

• Give us reasonable time to fix an issue before disclosing it publicly;
• Only test against your own instance or data — never anyone else's;
• Avoid privacy breaches, data destruction, and any disruption of service.

Scope

This covers software and websites operated by Purchon Innovation and Technology Limited. Because the software is offline-first and runs on each customer's own hardware, please only test an instance you own or control.