Vulnerability Disclosure Policy

1. Reporting vulnerabilities

• We welcome vulnerability reports made in good faith. Please avoid privacy violations, service disruption, and destructive actions.
• If you follow this policy, we will treat your research as authorised and will work with you to understand and resolve the issue.

2. How to Report

If you believe you have discovered a vulnerability in one of our services, or have a security incident to report:

• Please email security@worldcomputing.co.uk or
• Use the contact options on our website (https://www.worldcomputing.co.uk).
• If you prefer encrypted communication, please request our PGP key.

3. How the information is handled

Once we have received a vulnerability report, World Computing LTD takes a series of steps to address the issue:

• We will provide prompt acknowledgement of receipt of your report of the vulnerability.
• We request the reporter keep any communication regarding the vulnerability confidential.
• We will work with you to understand and investigate the vulnerability.
• We will provide a timeframe for addressing the vulnerability.
• We will notify you once the vulnerability has been resolved, to allow retesting by the reporter if needed.
• We publicly announce the vulnerability in the release notes of the update. We may also issue additional public announcements, for example via social media.
• Release notes (and blog posts when issued) will include a reference to the person/people who reported the vulnerability, unless the reporter(s) would prefer to stay anonymous.

4. Appreciations

World Computing LTD will endeavour to keep the reporter apprised of every step in this process as it occurs.

We greatly appreciate the efforts of security researchers and discoverers who share information on security issues with us, giving us a chance to improve our services, and better protect our customers.

5. Disclosure Good practice

In line with general responsible disclosure good practice, we ask that security researchers:

• Allow World Computing LTD an opportunity to correct a vulnerability within a reasonable time period before publicly disclosing the identified issue.
• Provide sufficient detail about the vulnerability to allow us to investigate successfully including steps required to reproduce the issue.
• We appreciate the use of the Common Vulnerability Scoring System when reporting a vulnerability.
• Do not modify or delete data, or take actions that would impact on World Computing LTD customers.
• Do not carry out social engineering exercises or to attempt to find weaknesses in the physical security of World Computing LTD offices or other locations.

6. Publicly Accessible

This policy is intended to be publicly accessible at https://www.worldcomputing.co.uk.

7. Changes to Privacy Policy

We may update this Privacy Policy periodically. Updates will be posted on this page.

8. Contact Us

If you have any questions regarding this Vulnerability Disclosure Policy, please contact us using the following details: