● Talk to a security engineer: +92 323 8295031info@protonyte.com  ·  PCSF batch enrolling now
// responsible disclosure

Found a hole in our own systems?
Tell us, and we will thank you for it

We test other people's systems for a living, so it would be a poor showing to be precious about our own. If you have found a security problem on anything Protonyte runs, we want to hear about it, and we will not come after you for telling us.

Write to Security@protonyte.com

Encrypted mail is welcome. If you would rather not use email, send it through the contact form and write SECURITY in the message.

You will hear back within 3 working days

If you have not, send a reminder - mail does go astray. We will tell you what we found, what we are doing about it, and roughly when.

What is in scope

Anything on these, including anything they run on:

  • protonyte.com and every subdomain of it
  • The admin panel, the enquiry form and the certificate register
  • Protonyte email, DNS and any service you can show belongs to us

What is out of scope

These are either not ours to fix or not worth either of our time:

  • Anything on a third party we merely use - our hosting provider, a social network, a payment page. Report those to them.
  • Findings from a scanner with nothing behind them: a missing header, a cookie flag, a TLS version, a version number in a banner, SPF or DMARC advice, clickjacking on a page with nothing to click.
  • Denial of service, load testing, mass scanning, brute force and anything else that degrades the site for other people.
  • Self-XSS, bugs that need a victim to paste code into a console, or that need a device that is already compromised.
  • Social engineering, phishing or physical attempts against our staff or our students.
  • Theoretical issues with no demonstrated impact.

How to test without causing trouble

  • Use your own data. Do not read, change, keep or publish anyone else's.
  • The moment you can prove a problem exists, stop. You do not need to see how far it goes to make the report credible.
  • If you do reach personal data by accident, stop, tell us at once, and delete your copy.
  • No automated scanning against the live site. One request at a time, by hand, is fine.
  • Give us a reasonable time to fix it before you publish. Ninety days is the usual understanding, and we will normally be much quicker. If you want to write it up, tell us and we will agree a date together.

Our side of the bargain - safe harbour

If you follow the rules above, in good faith and without harming anyone:

  • We will not report you to the authorities and we will not bring any legal action against you over the testing.
  • We will treat your report as authorised testing, not as an attack.
  • We will credit you on our hall of fame if you want to be named, and keep you anonymous if you do not.

One honest limit. This promise is ours to give about our own systems. It cannot protect you from a third party whose service you attack along the way, and nothing here is a waiver of anyone else's rights. Pakistan's Prevention of Electronic Crimes Act applies to you whatever we say, so stay inside the scope above.

What makes a report easy to act on

  • The address or endpoint, and exactly what you sent.
  • Steps anyone can follow to see it happen again. A short video is worth a page of prose.
  • What an attacker could actually do with it, in one paragraph.
  • The date and time you tested, and the address you tested from, so we can match it to our logs.
  • How you would like to be credited, or that you would rather not be.

What we can and cannot pay

We are a small firm and we do not run a paid bounty programme, so please do not send a report expecting an invoice to be settled. What we do offer is real: public credit on the hall of fame, a written reference you can show an employer, a free seat on the PCSF course, and for findings that genuinely matter, a thank-you payment at our discretion. We would rather say this plainly now than disappoint you later.

Machine-readable

The same contact details are published at /.well-known/security.txt, in the format described by RFC 9116.

Last updated 13 October 2026