To help us evaluate and respond to your report, please include:

• A description of the issue
• The affected URL, system, service, or IP address
• Steps required to reproduce the issue, if known
• Screenshots, logs, or supporting evidence, if available
• A method for us to contact you regarding the report

This policy applies to systems, services, and websites owned and operated by Bamshaw, LLC.

Third-party services, software, platforms, and infrastructure providers are outside the scope of this policy unless specifically identified as being under Bamshaw’s direct control.

When conducted in good faith, the following activities are generally permitted:

• Identifying potential security vulnerabilities
• Verifying vulnerabilities through limited testing
• Reporting findings through approved channels
• Avoiding disruption of normal operations

The following activities are not authorized:

• Denial-of-service or resource exhaustion testing
• Social engineering
• Physical security testing
• Accessing, modifying, or deleting data belonging to others
• Introducing malware, persistence mechanisms, or backdoors
• Exploiting vulnerabilities beyond what is reasonably necessary to demonstrate their existence
• Automated scanning intended to cause service degradation

Bamshaw will not pursue legal action against individuals who:

• Act in good faith
• Comply with this policy
• Promptly report discovered vulnerabilities
• Avoid unnecessary privacy violations, service disruptions, or destruction of data

This safe harbor applies only to activities consistent with this policy.

Please allow reasonable time for investigation and remediation before publicly disclosing a vulnerability.

Bamshaw does not guarantee specific response times, remediation timelines, or status updates.

Bamshaw does not currently operate a bug bounty program.

Bamshaw welcomes good-faith vulnerability reports intended to improve the security of systems under its control. Submission of a vulnerability report does not create any expectation of compensation, reward, consulting engagement, or other payment.

Attempts to condition disclosure upon payment or other consideration may be declined without response.

Bamshaw accepts vulnerability reports through its designated web-based reporting process.

Additional communication may occur through email when appropriate.

We do not support vulnerability reporting through social media platforms, instant messaging applications, or other real-time communication services.

Do not submit:

• Controlled Unclassified Information (CUI)
• Export-controlled information
• Classified information
• Personal information unrelated to the reported issue
• Information subject to government, regulatory, contractual, or legal restrictions on disclosure
• Any information that you are not authorized to share with Bamshaw