Security
Responsible disclosure
We're a security firm, so we expect people to test us. If you've found a vulnerability in a CyberBakery website or system, thank you. Please tell us before you tell anyone else, and give us a fair chance to fix it.
How to report
Email menu@cyberbakery.net with what you found and where (URL, system or component), the steps to reproduce it with screenshots or a short proof of concept, the impact you think it has, and how you'd like to be credited, if at all.
We don't publish a PGP key at this stage. If your report includes sensitive detail, say so in your first message and we'll arrange a secure way to share it.
What we ask of you
• Test only what you need to show the issue exists.
• Don't access, change or keep data that isn't yours. If you come across personal or client information, stop and tell us.
• Don't run denial-of-service tests, social engineering, physical tests, or automated scans that generate heavy traffic.
• Give us 90 days to fix the issue before you publish anything, unless we agree on a different timeline.
What you can expect from us
• An acknowledgement within 3 business days.
• An initial assessment and next steps within 10 business days.
• Updates while we work on a fix, and a note when it's done.
• Credit on this page if you'd like it, once the issue is resolved.
We won't pursue or support legal action against anyone who reports in good faith and stays within these guidelines. We don't run a paid bug bounty at this stage.
In scope
cyberbakery.net and its subdomains, including blog.cyberbakery.net.
Out of scope
• Third-party platforms we use but don't operate, such as our website host and form providers. Please report those to the vendor.
• Missing security headers or best-practice settings with no demonstrable impact.
• Reports produced only by automated scanners.
• Vulnerabilities in a client's systems. If you've found one, contact that organisation directly.
