This page is for reporting weaknesses in our own website. If your organization is experiencing a cyber incident and needs help, go to our incident response page instead.
How to report
Email info@securebits.africa with the subject “Security vulnerability report”. Please include:
- the affected URL or component;
- a description of the issue and its potential impact;
- clear steps to reproduce it, with screenshots or a proof of concept where helpful; and
- how you would like to be credited, if at all.
Scope
In scope: securebits.africaand its pages, forms, solution assistant and API endpoints. Out of scope: third-party services we link to (such as WhatsApp or LinkedIn), our technology vendors' products (please report those to the vendor), and findings that need physical access or social engineering of our staff.
Please don't
- access, change or delete data that does not belong to you, including other visitors' enquiries;
- run denial-of-service, load or brute-force tests;
- use automated scanners that send large volumes of requests through our forms;
- attempt phishing or social engineering of Securebits staff; or
- disclose the issue publicly before we have had a reasonable chance to fix it.
What to expect
- We aim to acknowledge your report within 3 business days.
- We will investigate, keep you informed of progress and tell you when the issue is fixed.
- With your permission, we will credit you once the fix is in place.
We do not currently run a paid bug bounty programme.
Good-faith research
If you act in good faith and follow this policy, we will not initiate or support legal action against you for your research, and we will treat your report as a contribution to the security of the website.