Responsible Disclosure Policy
If you believe you have found a security issue affecting a HAPSA-owned website or public tool, please report it privately so we can investigate and fix it.
What to include
- The affected URL or asset
- A concise description of the issue and likely impact
- Reproduction steps using the least harmful proof possible
- Relevant request/response details with secrets and personal data removed
- How we can contact you and whether you want attribution
Good-faith research
Keep testing limited to what is necessary to demonstrate the issue. Stop immediately if you encounter personal data, credentials, internal documents or evidence of an active compromise. Do not download, retain, alter or disclose that material; tell us what you encountered and where.
We ask that you avoid denial of service, social engineering, physical attacks, automated high-volume scanning, persistence, data destruction, spam, privacy violations and testing of third-party services that we do not own.
Our response
We aim to acknowledge a credible report within three business days, provide an initial assessment when practical, and keep the reporter informed at reasonable milestones. Remediation time depends on severity, reproducibility and dependencies. These are targets, not contractual service levels.
Disclosure coordination
Please allow reasonable time for investigation and remediation before public disclosure. We will not ask you to conceal an unresolved risk indefinitely. Coordinate timing with us so users are not exposed unnecessarily.
Scope and limitations
This policy covers internet-facing systems and content that HAPSA Technologies owns and operates under hapsatechnologies.com. Third-party platforms, hosting infrastructure and linked services are governed by their respective disclosure programmes. This policy does not create a bug-bounty programme, promise payment, or authorise activity that would otherwise be unlawful.