Responsible Disclosure Policy

1. How to report

Email info@boffincoders.com with the subject line starting [SECURITY]. Please include:

• the address or screen affected, and what an attacker could do;
• steps to reproduce, with any proof-of-concept, screenshots or request samples;
• your name or handle, if you would like to be credited.

Do not include real personal data you may have seen; describe it instead.

2. What we promise

• We acknowledge your report within 48 hours.
• We keep you informed while we investigate and fix it, and tell you when it is resolved.
• With your permission, we credit you once the issue is fixed.

3. Rules for testing

• Test only with accounts you own or have permission to use. Never access, change or delete other people’s data.
• Stop as soon as you reach personal data and report what you found.
• No denial-of-service, spam, social engineering of staff, schools or parents, or physical attacks.
• No automated scanning that sends large volumes of requests.
• Give us reasonable time to fix the issue before telling anyone else, and do not share details publicly until we agree.

4. Safe harbour

If you act in good faith and follow this policy, we will treat your research as authorised, we will not take legal action against you, and we will not ask the authorities to act against you for it. If someone else takes action against you for research under this policy, we will make it known that you acted with our authorisation. This does not cover activity that breaks the rules above or the law.

5. Scope

In scope: this website, school portals at *.acadvio.com, and the Acadvio mobile apps.

Out of scope: findings without a demonstrated security impact, such as missing headers with no exploit, clickjacking on pages without sensitive actions, self-XSS, logout CSRF, rate limits on non-sensitive forms, reports from automated tools without validation, issues in third-party services we do not control, and schools’ own custom domains or email servers.

6. Rewards

We do not run a paid bug bounty at present. We are grateful for every responsible report.