Responsible vulnerability disclosure.
A safe route for reporting suspected security weaknesses without creating additional harm or unauthorized access.
Safe reporting
Report the affected public service, observed behavior, time, minimal reproduction steps and contact route. Stop testing if access to personal, confidential, Board or third-party information becomes possible.
Prohibited activity
Do not use destructive testing, denial of service, social engineering, credential attacks, persistence, data extraction or publication of an unremediated weakness. This page does not authorize activity prohibited by law or contract.
BLACK& response
BLACK& aims to acknowledge a credible report, assign an owner, assess severity and communicate a remediation or coordination path where contact is possible. A fixed response-time commitment is not published until the operational service level is formally approved.
Contact
Email hq@blackandi.com with the subject ‘Security — Confidential’. Request a protected transfer route before sending sensitive evidence.