Security and responsible disclosure

Security reporting contact

Email [email protected] with the subject “DemoSoft security report”. For spam, abuse or account issues, use the separate reporting channel.

What to include

• The affected URL and a short description.
• Reproduction steps using your own test account and a minimal, safe example.
• Expected and observed behaviour, potential impact and approximate observation time.
• Screenshots or request excerpts with passwords, tokens and personal data removed.

Scope and safe testing

This procedure covers demosoft.uk. External sites listed in the catalogue, hosting providers and payment services have their own reporting channels and rules. Request explicit permission and agree on the scope before testing beyond normal use of your own account.

Do not access or modify other people’s data. Do not perform denial-of-service testing, bulk requests, social engineering or attempts to access other accounts. If you encounter another person’s data accidentally, stop testing and report only the minimum information needed to locate the issue.

Coordinated disclosure

The team reviews reports, asks for any necessary details and coordinates next steps with the reporter. Please allow this coordination before publishing technical details that could put users at risk. No guaranteed monetary reward programme has been announced.