Responsible Disclosure Policy

Introduction

At ClickPatrol, protecting our customers, users and systems is a priority. We welcome responsible reports from security researchers who believe they have discovered a vulnerability affecting our services.

This policy explains how to report a potential vulnerability and the standards we expect researchers to follow.

How to report a vulnerability

Please send your report via the Contact us form with the question type: “Security/Privacy/Bug questions”.

Start your message with:
Responsible Disclosure: [brief vulnerability description]

Please include:

• The affected product, service, domain or endpoint
• A clear description of the vulnerability
• Steps required to reproduce it
• Its potential security impact
• Relevant screenshots, logs or proof-of-concept code
• Your contact details, if you would like a response
• Whether you intend to disclose the vulnerability publicly

Do not include personal data belonging to other users unless it is strictly necessary to demonstrate the issue. Any such data must be securely redacted or minimized.

Research guidelines

When investigating a potential vulnerability, please:

• Test only against accounts and data that you own or have permission to use.
• Make a good-faith effort to avoid privacy violations, service disruption and data loss.
• Access only the minimum information necessary to demonstrate the vulnerability.
• Stop testing and notify us immediately if you encounter personal, confidential or commercially sensitive information.
• Give ClickPatrol reasonable time to investigate and resolve the issue before making it public.
• Securely delete any data obtained during your research after the issue has been resolved.

Prohibited activities

The following activities are not authorized:

• Denial-of-service or resource-exhaustion attacks
• Automated testing that produces excessive traffic
• Social engineering, phishing or impersonation
• Physical attacks against ClickPatrol facilities or personnel
• Accessing, modifying or deleting another user’s data
• Installing malware or maintaining persistent access
• Credential stuffing or testing stolen credentials
• Extortion or demanding payment in exchange for withholding disclosure
• Disclosing a vulnerability before ClickPatrol has had a reasonable opportunity to investigate and address it

Our response

After receiving a report, ClickPatrol will aim to:

• Acknowledge receipt within 3 working days
• Conduct an initial assessment within 10 working days
• Keep the reporter informed of material progress
• Resolve confirmed vulnerabilities according to their severity and complexity
• Notify the reporter when remediation has been completed

These timelines are targets and may vary depending on the nature of the issue.

Safe-harbour statement

If you act in good faith and comply with this policy, ClickPatrol will not initiate legal action against you for your authorized security research.

This safe harbour does not apply to unlawful conduct, privacy violations, intentional disruption, extortion, or activities that fall outside this policy. It also cannot authorize activity against third-party systems or protect you from legal action by third parties.

If you are uncertain whether a proposed test is permitted, contact us before proceeding.

Recognition and rewards

ClickPatrol does not currently operate a paid bug-bounty program. Submission of a report does not create an entitlement to compensation.

At our discretion, and with your permission, we may publicly recognize researchers who provide useful and responsibly disclosed reports.

Confidentiality and disclosure

Please keep reported vulnerabilities confidential until ClickPatrol confirms that remediation is complete or agrees to a disclosure date.

Any public disclosure should be coordinated with ClickPatrol to reduce risk to customers and users.

Personal information

Information submitted through this process will be used to investigate, communicate about and resolve the reported issue. ClickPatrol will process personal information in accordance with its Privacy Policy and applicable data-protection requirements.

Contact

Security reports: Contact us
General enquiries: Contact us

Last updated: 06-04-2026