Last updated 12 October 2026
Vulnerability disclosure policy
We want to hear about security problems in our products. This page says how to tell us, what we do with your report and what we ask of you.
What is covered
PatchClock, in the versions we still support. Our websites are welcome too.
How to report
Use the report form or write to security@patchclock.com. Tell us the product and version, what an attacker could do and how to reproduce it.
What we do
- Confirm your report within 2 working days.
- Keep you updated while we work on a fix.
- Publish a security notice when the fix is out, and credit you if you want.
- Report actively exploited vulnerabilities to the competent CSIRT, as the EU Cyber Resilience Act requires.
What we ask
- Give us up to 90 days to release a fix before you publish details. We will agree a date with you.
- Only test against your own install. Do not access, change or delete other people's data.
- Do not run denial-of-service tests or social engineering.
Good-faith research
Research that follows this policy is welcome, and we will not take legal action against it.