Security · Responsible disclosure
Responsible disclosure
Last updated 30 October 2026
Found a weakness in one of our systems? Tell us. We acknowledge every report immediately, and researchers who act in good faith won't face legal action from us.
How to report
Email security@refact0.com with:
- what you found and where (the URL or system);
- the steps to reproduce it;
- what an attacker could do with it;
- how we can reach you.
If you came across personal data, describe it rather than sending it to us.
What happens next
- An acknowledgement reaches you as soon as your report arrives.
- We look into it, keep you updated, and tell you when it's fixed.
- We ask you to give us 90 days to fix it before you publish anything.
Scope
refact0.com and the subdomains we operate.
Acting in good faith
- Test only against accounts and data that are yours.
- Don't access, change or delete other people's data. If you reach it by accident, stop and tell us.
- Don't run denial-of-service attacks, send spam, or try social engineering or physical attacks.
- Don't share the issue with anyone else until it's fixed or 90 days have passed.
If you follow these rules, we treat your research as authorised and won't take legal action against you.