Security Policy

Scope

This policy applies to the website at uapp.group and the forms it serves. Services we use but do not operate, such as analytics, consent and anti-spam providers, are out of scope; report issues in them to their vendors.

Out of scope are denial-of-service attacks, social engineering of our staff, physical access, and findings that need a compromised device or browser.

How to report

Email office@uapp.group with the subject “Security report”. Include:

• the address or form affected;
• the steps to reproduce the issue;
• what an attacker could achieve with it;
• how you would like to be credited, if at all.

What we ask

• Test only against your own data and accounts, and stop as soon as you reach anyone else's.
• Do not degrade the site for other visitors: no denial of service and no high-volume automated scanning.
• Do not send test submissions through the contact forms beyond what a report needs.
• Keep the issue confidential until we have fixed it, or until 90 days after your report, whichever comes first.

What we commit to

• We acknowledge every report within five working days.
• We keep you informed while we assess and fix the issue.
• We credit you once the fix is live, if you want to be credited.
• We will not take legal action against research done in good faith within this policy.

We do not run a paid bug bounty programme.