Security Policy (Vulnerability Disclosure)

Responsible disclosure guidelines for Kilowatts.uk systems and services.

Kilowatts.uk welcomes responsible security research and values the contribution of security researchers in helping us maintain the safety and integrity of our systems.

If you believe you have discovered a vulnerability affecting a publicly accessible Kilowatts.uk system or service, please report it to security@kilowatts.uk.

1. Purpose

This Vulnerability Disclosure Policy defines how security vulnerabilities in Kilowatts.uk systems and services should be reported and handled in a responsible, coordinated, and secure manner.

2. Scope

This policy applies to publicly accessible services, applications, and infrastructure operated by Kilowatts.uk under the kilowatts.uk domain and its subdomains.

Third-party services, external platforms, and infrastructure not directly controlled by Kilowatts.uk are considered out of scope unless explicitly stated otherwise.

3. Responsible Disclosure Guidelines

Act in good faith and avoid any actions that could impact privacy, availability, or data integrity.
Do not access, modify, or delete data that does not belong to you.
Do not perform social engineering, phishing, or physical security testing.
Do not attempt denial-of-service attacks or service disruption.
Do not publicly disclose vulnerabilities before they have been resolved or coordinated.
Limit testing strictly to what is required to demonstrate the issue.

4. Safe Harbour

Kilowatts.uk supports good-faith security research conducted in accordance with this policy.

We will not pursue legal action against individuals who:

Follow this policy in good faith
Avoid privacy violations and unnecessary data exposure
Do not disrupt services or degrade system availability

5. Reporting a Vulnerability

Please include the following information in your report:

A clear description of the vulnerability
Affected URL, system, or component
Steps required to reproduce the issue
Any proof-of-concept or supporting evidence
Your contact details for follow-up communication

Reports should be submitted to: security@kilowatts.uk

6. Handling and Response

We aim to acknowledge valid vulnerability reports within a reasonable timeframe. All submissions are reviewed and investigated based on severity and operational impact.

Resolution timelines may vary depending on complexity, risk level, and system dependencies.

7. Coordinated Disclosure

We request that vulnerabilities are not publicly disclosed until a fix has been implemented or agreed upon through coordinated disclosure with Kilowatts.uk.