Security & Vulnerability Disclosure Policy

This policy provides a safe channel for good-faith security researchers to report vulnerabilities affecting HostingTom-controlled systems.

1. Scope

This policy applies to public HostingTom websites, client interfaces and systems that HostingTom directly controls. Customer-hosted websites, third-party datacenter systems and vendor applications are outside scope unless HostingTom expressly confirms otherwise.

2. Good-Faith Research

Researchers should avoid accessing, downloading, modifying or deleting other users’ data; avoid denial-of-service, spam, social engineering, physical testing and automated scanning that materially degrades systems; and stop testing once sensitive data or a critical vulnerability is discovered.

3. Reporting

Email [email protected] with “SECURITY REPORT” in the subject. Include the affected asset, steps to reproduce, impact, screenshots or proof-of-concept that minimizes harm, and contact information for follow-up.

4. What We Commit To

We aim to acknowledge credible reports, investigate them in good faith and keep researchers informed of material progress where practical. We do not promise a bounty unless agreed in writing before disclosure.

5. Public Disclosure

Please allow reasonable time for remediation before public disclosure. Coordinate disclosure timing with HostingTom, particularly for vulnerabilities that could expose customer data or enable active exploitation.