Vulnerability Disclosure Policy

Report suspected vulnerabilities to Prodia Systems Limited through its verified telephone number or registered office, asking for a private security-reporting channel. A dedicated security email address is not published pending verification. Provide the affected URL, minimal reproduction steps and the potential impact without including secrets or unnecessary personal data.

This policy is not blanket permission to test, a bug bounty or a legal safe-harbour promise. Obtain explicit written authorisation before active testing. Do not perform denial-of-service, social engineering, credential attacks, destructive operations, persistence or access to third-party infrastructure.

If you unexpectedly encounter sensitive information, stop, retain only the minimum information needed to describe the issue and report it privately. Do not publicly disclose details that would enable exploitation while a report is being considered.

The company will consider reports, but this draft does not promise a response deadline, reward or remediation service-level agreement. Third-party services remain outside any authorisation the company can grant.