Responsible Disclosure

Report a security issue

Email scott@haltseal.com with the subject HALTSEAL security report. Include the affected URL, a short description of the issue and its potential impact, and the minimum steps needed to reproduce it. A redacted screenshot or brief technical example is helpful when it can be shared safely.

Keep the first message minimal. Do not send passwords, private keys, live credentials, payment information, personal records, or a full data dump. If the details are sensitive, describe the issue at a high level and request a secure exchange channel before sending them.

If email is returned as undeliverable, use the Contact form with a nonsensitive summary and ask for a suitable reporting channel. You may report anonymously; a return address helps us ask questions and provide updates.

Scope

This policy covers the public website at https://haltseal.com and the redirect from https://www.haltseal.com to that website, only to the extent we control them. It includes the public pages, browser-delivered site assets, browser demonstration, and configuration we control that is served for those hostnames.

Other subdomains, origin addresses, administrative interfaces, repositories, downloadable software packages, APIs, customer environments, payment systems, and third-party services are outside this policy's testing scope. The authorization does not extend to a hosting, CDN, DNS, email, or other provider's shared infrastructure. Public visibility or a link from HALTSEAL does not expand the scope.

Authorized research

You may inspect publicly delivered site content and conduct limited, low-volume, non-disruptive checks of an in-scope public endpoint to confirm a suspected vulnerability. Use only data and devices you own or are authorized to use, and stop once you have enough information for a useful report. No separate permission or NDA is required for research within these limits.

To protect other people and systems:

• Do not disrupt availability, exhaust resources, send bulk requests, or perform denial-of-service, destructive, social-engineering, or physical testing.
• Do not access accounts or private systems, use discovered credentials, establish persistence, move to another system, or initiate any real payment or other external transaction.
• Do not intentionally access, change, delete, copy, or expose information belonging to another person. If you unexpectedly encounter private information, stop the affected activity, avoid further inspection, and report the issue promptly with minimal redacted evidence. Ask us how to handle any material already received.
• If a proposed test falls outside these limits or could affect a third party, obtain specific written authorization from the party with authority over that system before proceeding.

Our commitment to good-faith research

We consider research conducted in good faith within this policy authorized to the extent we have authority to give that permission. For that research, we will not initiate or support a legal claim against you based on the research, and will not assert conflicting restrictions in our website terms. This commitment includes accidental, limited exposure to private information when you promptly stop, minimize, report, and do not misuse or disclose that information.

This commitment covers claims and systems we control. It cannot authorize activity on behalf of another party or bind customers, service providers, courts, regulators, or law enforcement. It does not protect malicious exploitation, extortion, data misuse, or activity outside the stated scope. A request about a possible reward does not by itself establish bad faith.

Changes to this policy will not retroactively withdraw our authorization or this commitment for research that complied with the policy when performed. If we ask you to stop or narrow further testing to prevent harm, please do so; that request does not erase protection for earlier compliant research.

Review and coordinated disclosure

We will assess reports, ask for clarification where useful, and communicate material progress when we have a return contact. Priorities and timing depend on the issue and its impact; this policy does not promise a fixed response or remediation deadline.

Please report privately first and discuss a reasonable, time-limited plan with us before publishing details that would enable exploitation. We do not require indefinite nondisclosure as a condition of reporting, and this policy does not restrict lawful reporting to authorities. Avoid publishing personal information, credentials, or other people's confidential information.

We use report information to investigate, remediate, and coordinate necessary responses, subject to the Privacy Notice. This policy does not establish a paid bug bounty or an entitlement to payment. We will seek your agreement before publicly identifying you as the reporter.

For the contact file, see security.txt.