Responsible Disclosure · Last updated 17 July 2026
Found something? Tell us.
We ask our clients to run a disclosure process. It would be poor form not to run one ourselves. If you’ve found a security issue in a system we operate, we want to hear about it, and we won’t pursue you for telling us in good faith.
How to reach us
Email security@invictuscybersecurity.tech. Ask for a PGP key if you’d rather encrypt the report and we’ll send one.
Useful things to include: what you found, where, how to reproduce it, and what an attacker could do with it. A rough note beats no note — don’t polish it, just send it.
What we commit to
- We acknowledge your report within two business days.
- We tell you what we decided and why — including if we decide not to fix it.
- We will not take legal action against you for good-faith research that follows the boundaries below.
- We credit you publicly if you want it, and stay quiet if you don’t.
What we ask of you
- Give us reasonable time to fix it before publishing.
- Don’t access, modify or delete data that isn’t yours. If you stumble into someone’s data, stop and tell us.
- No denial of service, no spam, no social engineering of our people or our clients.
- Test only systems we actually operate — see scope below.
Scope
In scope: invictuscybersecurity.tech and its subdomains.
Out of scope: our third-party providers — Webflow, Google, Proton, Calendly — who run their own disclosure programmes; please report to them directly. Also out of scope: any client system. We do not own them and cannot authorize testing against them. Testing a client environment because you found it through us is not covered by this policy and is not something we can protect you from.