Security is a shared signal.
DarkRisk welcomes responsible vulnerability reports. This centre explains how to report an issue, what responsible testing looks like, and what to expect from us.
- Contact: mailto:security@darkrisk.io
- Policy: https://security.darkrisk.io/vulnerability-disclosure/
- Preferred-Languages: en
- Canonical: https://security.darkrisk.io/.well-known/security.txt
- Expires: 2027-08-01T00:00:00.000Z
Vulnerability disclosure
Our commitment to researchers.
DarkRisk is committed to safeguarding its systems and the information entrusted to us by customers, partners, employees and users. We recognise the role independent security researchers play in strengthening the technology ecosystem.
When we receive a legitimate report that follows this policy, we assess it in good faith, assign appropriate resources and work to address confirmed issues as quickly as reasonably possible.
Good-faith research that follows this policy is treated as authorised security research. DarkRisk will not pursue legal action against a researcher solely for that compliant activity.
Report an issue
Send us the signal.
If you believe you have found a vulnerability in a DarkRisk-owned asset, or need to report a security incident, email us.
security@darkrisk.io- To
- security@darkrisk.io
- Subject
- Security report
- 01Affected assetThe domain, endpoint, product or asset.
- 02ImpactA clear description of the issue and its potential impact.
- 03Steps to reproduceReproducible steps or a minimal proof of concept.
- 04EvidenceTimestamps, request details, screenshots or logs.
- 05How to reach youA safe way for us to follow up with questions.
Leave out live credentials, unnecessary personal information and anyone else’s data.
Send it to security@darkrisk.io
Test safely. Protect people first.
Do
- Test only systems and accounts you own or are explicitly authorised to use.
- Stop immediately if you encounter personal information, credentials or customer data.
- Use the minimum interaction needed to demonstrate the vulnerability.
- Report findings promptly, clearly and without conditions attached.
- Allow DarkRisk reasonable time to investigate and remediate before disclosure.
Do not
- Exfiltrating, retaining, changing, destroying or publicly exposing data.
- Social engineering, phishing, physical intrusion or targeting our people.
- Denial-of-service testing, traffic flooding, spam or resource exhaustion.
- Automated scanning that degrades service or generates excessive traffic.
- Pivoting beyond the first vulnerability or weakening other security controls.
In scope
Internet-accessible systems and applications owned and operated by DarkRisk, including DarkRisk-controlled domains and subdomains.
Out of scope
Third-party services, unless DarkRisk confirms otherwise in writing. If ownership is unclear, contact us before testing.
No bug bounty
This is a disclosure programme, not a paid bug bounty. Rewards are not promised unless agreed in writing before you report.
What happens next.
- 01
Receipt
We receive your report through our security channel and ask that related communication stays confidential.
- 02
Verification
We review the evidence, reproduce the issue where possible, and establish its scope and severity.
- 03
Remediation
We correct the issue or deploy mitigations, prioritising the protection of customers and users.
- 04
Communication
We aim to keep you informed as the investigation progresses, and confirm when the issue is addressed.