Report a security issue

PRIVATE TEST SITE POLICY • This page is a staged vulnerability-reporting route, not a bug bounty and not permission to access systems, accounts or data unlawfully.

How to report

Report a suspected RigWave security weakness privately to info@rigwavesystems.co.uk. A controlled pre-launch round trip has proved that this mailbox can receive a report and send a manual reply. Do not send passwords, stream keys, access tokens, recovery codes, payment-card data or unrelated personal data. Automated acknowledgement, response-time targets and continuous hosted availability are not claimed by this evidence.

• The affected RigWave version, file or URL.
• A concise description of the suspected vulnerability and its impact.
• Safe reproduction steps using your own test data/account where possible.
• Any logs or screenshots that do not expose secrets or other people’s data.
• A contact address so RigWave can ask bounded follow-up questions.

Research boundaries

• Use only systems, accounts, devices and data you are authorised to test.
• Do not socially engineer or phish customers, staff, suppliers or provider support.
• Do not perform denial-of-service, destructive, persistence or ransomware-style testing.
• Do not bypass payment, entitlement, provider or access controls to obtain an unauthorised benefit.
• Do not access, copy, modify, delete, retain or publish more personal/customer data than is strictly necessary to demonstrate a genuine issue. Stop if another person’s data is exposed.
• Do not publicly disclose a secret, credential or exploitable detail before RigWave has had a reasonable opportunity to investigate and mitigate it.

What this policy does not promise

This policy does not create a legal safe harbour beyond rights available under applicable law, does not override a third-party provider’s rules and does not authorise unlawful access. It also does not promise payment or a fixed response time. RigWave will aim to acknowledge genuine reports, triage them, preserve necessary evidence and fix or mitigate verified issues proportionately.

Privacy for security reports

Information in a report should be limited to what is needed to investigate the issue. RigWave should restrict access to the people or processors who need it, avoid placing secrets in ordinary support bundles, and retain report material only for a justified security, legal or dispute purpose. The final public privacy/retention schedule remains subject to professional review.

Machine-readable contact

This staged package prepares /.well-known/security.txt with the same verified email contact, a canonical HTTPS location, this policy URL and a bounded expiry date. Before hosted beta/customer reliance, RigWave must still prove the deployed HTTPS file is reachable, refresh the expiry if needed and recheck the published contact details.

Release status

RigWave remains private pre-release. Code signing, SmartScreen reputation, exact final Defender evidence, hosted security headers, live provider permissions, penetration testing where appropriate and professional legal/privacy/OSS review remain separate final release checks.