Reporting a security vulnerability

If you think you've found a security vulnerability in any ProtoFlex module, please tell us at security@protoflex.co.uk. We value every report. We don't offer payment or rewards.

Please include: the product, version or web address; what the vulnerability is; steps to reproduce it with a harmless proof of concept; and what an attacker could do with it. You can report anonymously. Please don't send any personal data: describe what you saw instead. If you need a more secure way to send something, say so and we'll arrange one.

Please don't test live systems

Every live ProtoFlex environment belongs to one of our customers and may hold personal data, so we can't authorise testing of it. Only test an environment if the organisation that runs it has authorised you to do so; if it has, please report product vulnerabilities to us as well. If you notice a problem during normal use, report it rather than investigating further.

In particular, don't access or keep other people's data, change data, disrupt a service, run denial-of-service or high-volume tools, or try social engineering. If you come across personal data, stop and tell us straight away.

What happens next

We'll acknowledge your report within 2 working days and tell you our assessment and planned next steps within 5 working days. We'll keep you updated until it's resolved and tell you when it's fixed.

Please don't share details publicly until a fix has been released and our customers have had time to install it; we'll agree a date with you. With your agreement, we'll credit you in our advisory to customers.

Legal

If you act in good faith and within this policy, we won't take or support legal action against you over your report. This policy can't authorise anything in a system that belongs to someone else, including our customers' environments.

Last updated: November 2026.