Security
Vulnerability Disclosure
JandaSec takes the security of its systems and website seriously and supports responsible reporting of genuine security vulnerabilities.
JandaSec does not operate a public bug bounty programme or public security research programme. Publication of this policy, or of our security.txt file, does not provide permission to test, scan, probe or attempt to exploit JandaSec systems.
Reporting a vulnerability
If you become aware of a genuine security vulnerability affecting a JandaSec-controlled system or this website, please report it through the secure reporting route published in our machine-readable security policy:
/.well-known/security.txt
The current reporting method and encryption information are maintained there so that they can be updated without duplicating contact details across the website.
When reporting an issue, please provide enough information for us to understand and assess it, such as:
- The affected system, page or resource
- A clear description of the issue
- The steps needed to reproduce it
- The potential security impact
- Relevant evidence that helps us validate the issue
Please avoid including unnecessary personal, confidential or customer information.
What JandaSec does not authorise
Unless expressly agreed with JandaSec in writing, this policy does not authorise third parties to:
- Perform vulnerability scanning, penetration testing or automated security testing
- Attempt to gain unauthorised access to systems, accounts or data
- Access, download, modify or retain information that is not their own
- Introduce malware, persistence mechanisms or test payloads that could affect availability or integrity
- Conduct denial-of-service or other disruptive testing
- Perform social-engineering attacks against JandaSec, its clients, suppliers or partners
- Test systems belonging to JandaSec clients or other third parties
- Publicly disclose an issue before JandaSec has had a reasonable opportunity to investigate and respond
If testing has been separately commissioned or authorised by JandaSec, the agreed engagement terms take precedence.
Bug bounties and compensation
JandaSec does not operate a paid bug bounty programme.
Reporting a vulnerability does not create any entitlement to payment, reward, recognition, contractual engagement or ongoing correspondence.
Requests for payment in exchange for vulnerability information will not be accepted.
How reports are handled
Genuine reports submitted through the published reporting route will be considered in line with their apparent relevance and potential impact.
JandaSec may investigate, remediate or otherwise respond to a report at its discretion. We do not make a general commitment to provide acknowledgement, remediation timescales, status updates or public recognition.
Our priority is to protect JandaSec, its clients and anyone who may be affected by a genuine security issue.
Why JandaSec takes this approach
Operating an open bug bounty or public security research programme requires dedicated processes, legal arrangements, triage capacity and ongoing operational resource.
For a business of JandaSec’s size and operating model, an unrestricted public testing programme would introduce unnecessary operational and security risk, including unsolicited scanning, low-quality or duplicate submissions, potential disruption and inappropriate access to systems or information.
JandaSec therefore maintains controlled vulnerability-management processes while still providing a clear, secure route for genuine issues to be reported.
security.txt
JandaSec supports the security.txt standard defined by RFC 9116 and publishes its current vulnerability-reporting information at:
https://jandasec.com/.well-known/security.txt
The file provides the authoritative reporting contact, encryption information and a link back to this policy.
The presence of security.txt should not be interpreted as permission to perform security testing against JandaSec systems.
Last reviewed: 18 October 2026