If you believe you have found a vulnerability in a Novasean-operated website, client portal or hosting component, use our contact page to ask how to report it securely. Identify the affected service or domain and give a short, non-sensitive description. Do not put exploit code, credentials, customer records or medical personal data in a general enquiry. Customers may also use the authenticated support channel in their applicable agreement.
Please avoid accessing, changing or copying another person's data; disrupting a service; testing beyond what is needed to explain your observation; or publishing a working exploit before a coordinated discussion. Stop if your activity reaches information you are not authorised to see. Preserve only the minimum information needed to explain the issue and use a secure channel agreed with the recipient for technical detail.
How a report is assessed depends on the affected service and any applicable incident, privacy or contractual duties. This statement does not promise a particular acknowledgement period, bounty, confidentiality outcome, commitment not to prosecute or deadline for fixing the issue. A vulnerability in a customer-managed application or third-party product may need to be reported to its responsible operator. Running on a Novasean-hosted VM does not by itself make a vulnerability an issue in Novasean's infrastructure.
For an urgent threat to people, contact the appropriate emergency authority. For concerns about allegedly unlawful content, use Report illegal content. Do not include sensitive records in an initial enquiry.