Security & Responsible Disclosure
Practical security expectations for our website, delivery practices and good-faith vulnerability reporting.
Security commitment
Portalwiz treats security as a shared responsibility across website operations, software delivery and client engagements. Controls are selected based on system risk, scope, hosting environment and contractual requirements.
Website security practices
Our public website security approach includes encrypted transport, controlled server-side form processing, input sanitisation, anti-spam controls, privacy choices, secure external-link handling and a responsible-disclosure channel. Production hosting should additionally enforce TLS, secure headers, backups, patching, monitoring and least-privilege administration.
Responsible disclosure
If you believe you found a security vulnerability in a Portalwiz-owned public system, report it to contact@portalwiz.com with the subject “Security Vulnerability”. Include the affected URL/system, steps to reproduce and potential impact. Avoid sending exploit code containing personal or client data unless requested.
Research guidelines
Please do not perform denial-of-service testing, destructive testing, social engineering, physical intrusion, credential stuffing, automated high-volume scanning or access data that is not yours. Give us reasonable time to investigate before public disclosure.
Client systems
Do not test or report client-owned systems through this process unless Portalwiz has explicitly identified them as in scope. Vulnerabilities in third-party products should normally be reported to the relevant vendor.
No bounty promise
This public disclosure process does not create a bug-bounty program or guarantee compensation. Portalwiz may acknowledge good-faith reports at its discretion.