Vulnerability disclosure policy

If you think you've found a security weakness in GolfSec Academy, please tell us at security@golfsec.co.uk. Include what you found, how to reproduce it, and how we can contact you.

We ask that you

• Only test against your own account, or a test club we've set up for you.
• Don't access, change or delete other people's data, and stop as soon as you see any.
• Don't run denial-of-service, spam or social engineering tests against clubs or GolfSec staff.
• Give us reasonable time to fix the issue before you tell anyone else.

We will

• Acknowledge your report within 5 working days.
• Keep you updated, and credit you if you'd like.
• Not take legal action against good-faith research that follows this policy.

Based on the NCSC Vulnerability Disclosure Toolkit.