Three options. Use any.
Send a written description of the vulnerability, with proof-of-concept where appropriate, to the security mailbox.
Email: [[email protected]]
PGP key available at [/pgp-key.asc].
security.txt (RFC 9116)
Machine-readable contact published at /.well-known/security.txt, listing the security mailbox, encryption key, expiry, and policy URL (this page).
Path: /.well-known/security.txt
Whistleblowing channel
Reports may also be raised through the independent whistleblowing channel where confidentiality or anonymity is required.
What is in scope, and what is not.
| Status | Asset / activity |
|---|---|
| In scope | The public website at the Amberstone Capital Group production domain; the Schedule 4 self-certification gate; the Investor Data Room (when launched); supporting infrastructure operated by Amberstone or its named service providers. |
| In scope | Authentication, session management, gating-bypass, sensitive-data exposure, server-side request forgery, business-logic flaws, and any vulnerability that could disclose investor information or compromise the integrity of the Schedule 4 register. |
| Out of scope | Denial-of-service testing; physical security; social engineering of personnel; testing against systems not operated by Amberstone (e.g. the Registered Agent's portal, external whistleblowing portals, regulator websites). |
| Out of scope | Theoretical findings without proof-of-concept; rate-limit or version-disclosure issues without demonstrable impact; reports generated solely by automated scanners. |
Good-faith research is welcomed.
If you make a good-faith effort to comply with this policy, Amberstone will not initiate or support legal action against you arising out of your security research, and will treat your activity as authorised under applicable computer-misuse and data-protection law.
Good-faith effort means: (i) you stay within the scope above; (ii) you avoid privacy violations, destruction or modification of data, and disruption of services; (iii) you give us a reasonable time — not less than ninety (90) days — to investigate and remediate before any public disclosure; and (iv) you do not use, monetise, or disclose any vulnerability or data obtained through it for any purpose other than reporting it to us.
Good-faith effort does not extend to deliberate violation of law, exfiltration of personal data, extortion, or attempts to compromise live investor accounts.
What you will receive from us.
| Acknowledgement | Within one (1) Business Day of receipt — confirming receipt and assigning a tracking reference. |
| Triage | Within five (5) Business Days — confirming severity classification and the Group's intended remediation timeline. |
| Remediation | Critical: 24–72 hours. High: ≤ 14 days. Medium: ≤ 60 days. Low: at the next scheduled release. |
| Public disclosure | Coordinated. Default ninety (90) days from acknowledgement; extensions agreed in writing if remediation requires longer. |
| Credit | Where the reporter consents, the Group will publish a brief acknowledgement of the report on a Hall-of-Fame page once remediation is complete. |
| Bounty | The Group does not currently operate a paid bug-bounty programme. [Future engagement with HackerOne / Bugcrowd to be confirmed.] |
Report responsibly. We respond promptly.
The Compliance Officer maintains the security mailbox and triages every report. The Director (Operations / Compliance) is notified on receipt of any High or Critical finding. The Auditor and the Board are notified on closure.