Coordinated Disclosure

Anglostar takes the security of our website and infrastructure seriously. We welcome reports from security researchers who identify vulnerabilities in good faith, and we ask that you follow the coordinated disclosure practice described below so we can investigate and address issues before they are made public.

In scope:

• This website and its subdomains
• Web application vulnerabilities (e.g., injection, authentication, access control, exposed data)

Out of scope:

• Denial-of-service (DoS/DDoS) testing
• Social engineering or phishing of Anglostar staff
• Physical access attempts to Anglostar offices or facilities
• Third-party services we link to but do not operate
• Automated vulnerability scanning that generates significant traffic without prior coordination

Please email contact@anglostar.com with the subject line "Security Disclosure" and include:

• A description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce the issue
• Any proof-of-concept code, screenshots, or logs that support the report
• Your contact information for follow-up

Please do not include real personal data or confidential business information in your report or proof-of-concept if you encounter it — describe what you found without exfiltrating or retaining it.

• Acknowledgement of your report within 5 business days
• An assessment of the issue and, where applicable, a remediation timeline
• Credit for your discovery, if you would like it, once the issue is resolved
• No legal action against researchers who act in good faith, within this scope, and without accessing, modifying, or retaining data beyond what is necessary to demonstrate the vulnerability

• Publicly disclose a vulnerability before we have had a reasonable opportunity to address it
• Access, modify, or delete data belonging to Anglostar or third parties beyond what is strictly necessary to demonstrate the issue
• Use a finding to pursue further exploitation, or demand payment in exchange for a report

This policy is inspired by common industry coordinated-disclosure practice and may be refined as our program matures.