Security

Who is responsible

Ollie Darwin, co-founder, is the security lead at Kernl Digital Ltd. Ollie is responsible for the security of this website and of the software we build and run, and is the contact for anything on this page.

• Email: ollie@kernldigital.com
• Machine-readable contact: /.well-known/security.txt

Reporting a vulnerability

If you think you have found a security issue in kernldigital.com or in software we build and run, email ollie@kernldigital.com. Please include:

• Where the issue is (URL, app or API endpoint)
• What the issue is and what someone could do with it
• The steps needed to reproduce it
• Your name or handle, if you would like to be credited

What we will do

• Acknowledge your report within three working days.
• Look into it, confirm whether it is a vulnerability and keep you updated while we work on it.
• Fix confirmed issues and let you know once the fix is live.
• Credit you for the find, if you would like us to.

We do not run a paid bug bounty, so we cannot offer rewards for reports.

Testing in good faith

We will not take legal action against anyone who reports a vulnerability to us in good faith and follows this policy. That means you:

• Only access or change as much data as you need to show the issue, and do not keep it
• Do not degrade our services, for example with denial-of-service or high-volume automated testing
• Do not use social engineering, phishing or physical attacks against us, our clients or their users
• Give us reasonable time to fix the issue before you tell anyone else about it

Changes to this policy

We may update this policy from time to time. Any changes will be published on this page with a revised “last updated” date.