Home

Security

Responsible Disclosure

Last updated
16 May 2026

Our commitment

OFFCEPT operates at the intersection of offensive security research and client service. We understand the value of responsible disclosure and are committed to working with researchers who find vulnerabilities in our systems.

We will not pursue legal action against researchers who follow this disclosure policy in good faith. We ask that you extend the same respect to us that we extend to the security community.

What we promise

  • Acknowledgement within 48 hours of receiving your report
  • Regular updates on our progress towards a fix
  • Credit in our security acknowledgements (if you want it)
  • No legal action against researchers who follow this policy

Scope

The following systems are in scope for responsible disclosure:

  • offcept.com and all subdomains
  • Our client portal and engagement management systems
  • APIs and authentication mechanisms
  • Infrastructure hosting our public-facing services

The following are out of scope:

  • Social engineering or phishing against our employees
  • Denial of service attacks
  • Physical attacks against our offices
  • Third-party services not operated by OFFCEPT
  • Spam or brute-force attacks

How to report

Send an encrypted email to security@offcept.com. Include enough detail to reproduce the issue: affected system, steps to reproduce, and potential impact. Use our PGP key if the finding is sensitive.

The process

  • 1. Report: Send details to security@offcept.com. Include the affected system, steps to reproduce, and potential impact.
  • 2. Acknowledge: We will acknowledge your report within 48 hours and begin investigating. We will keep you updated and may ask follow-up questions.
  • 3. Fix: Once we have developed a fix, we will ask you to confirm it resolves the issue. We aim to resolve critical findings within 7 days and other findings within 30 days.
  • 4. Disclosure: We ask for 90 days before public disclosure. After that, you are free to publish your findings. We will credit you unless you prefer to remain anonymous.

PGP key

We encourage the use of PGP for encrypting sensitive vulnerability reports. Our public key fingerprint is 4FA6 5964 B2A3 17F3 D2F1 4D97 4C9A 8105 8E6E 4A68.

OFFCEPT Security <security@offcept.com>

-----BEGIN PGP PUBLIC KEY BLOCK-----

mDMEaoo5QhYJKwYBBAHaRw8BAQdASH99LLUnMRL3WFaMBnQEjDzfkv1L+23GGvVO
KUurk7W0J09GRkNFUFQgU2VjdXJpdHkgPHNlY3VyaXR5QG9mZmNlcHQuY29tPoiQ
BBMWCgA4FiEET6ZZZLKjF/PS8U2XTJqBBY5uSmgFAmqKOUICGwMFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQTJqBBY5uSmiaVwD/SF4hZqr95Azy/9o29S8v8K0p
Gqa9zr2LTldoVxFb1DkBAJX/HS+Xa1Qu+0XthGklrs/Y1Tk7H6lx5csySWITdDAM
uDgEaoo5jRIKKwYBBAGXVQEFAQEHQDX1Aka+X/kmowZqIR5xeZofjGh9MBU6o/1a
hSz4NExeAwEIB4h4BBgWCgAgFiEET6ZZZLKjF/PS8U2XTJqBBY5uSmgFAmqKOY0C
GwwACgkQTJqBBY5uSmj8iwD/eXGSfMtIVZ+4s7cV8mBW8e8Q1sG45En+Iow9n9+C
pXoA/0AZwp+4ltHqjKHhC764ydhs00NFCPLYKSoD2WuGKTYJ
=p8nU
-----END PGP PUBLIC KEY BLOCK-----

Contact

For vulnerability reports, email security@offcept.com.

We encourage the use of PGP for sensitive vulnerability reports.