Security disclosure

1. Reporting a vulnerability

Scout Atlas Limited ("the Company") welcomes reports of security vulnerabilities in the Scout Agency website. Send a report to legal@scoutatlas.uk. The same contact is published in machine-readable form at scoutagency.uk/.well-known/security.txt, as RFC 9116 describes.

Please include:

• the address (URL) or system affected;
• what you found and why you think it is a vulnerability;
• the steps to reproduce it, and any proof of concept;
• your name or handle and how to reach you, if you want a reply or credit.

Do not put passwords, personal data or other sensitive material in the email. We do not publish an encryption key for reports. If you need to send something sensitive, say so in the first email and we will agree a safer way.

2. What to expect

These are the Company's aims. They are not guarantees, and we will tell you if we cannot meet one.

• We aim to acknowledge a report within five working days.
• We aim to tell you within ten working days whether we have confirmed the issue.
• We aim to fix a confirmed vulnerability within 90 days of the report, and to tell you when the fix is live.
• We will keep you informed of progress if you give us a way to reach you.

Please do not publish details of a vulnerability until we have fixed it or 90 days have passed since your report, whichever is sooner, unless we agree another date with you. We do not run a bug bounty or pay rewards. On request we will credit you by name once the issue is resolved.

3. Scope

In scope: this website, scoutagency.uk, and the booking and enquiry service that serves it at api.scoutagency.uk, which the Company runs.

Out of scope:

• the systems of the Company's service providers, such as Vercel, Cloudflare and Google (including the Google account, Calendar, Meet, Gmail, Sheets and Apps Script that sit behind the booking service). We cannot authorise testing of them. Report a fault in a provider's own service to that provider;
• other Scout Atlas websites, products or services, and any division with its own disclosure policy;
• our clients' systems, which we test only under a separate signed written authorisation from the client;
• denial-of-service, load or stress testing;
• social engineering, phishing, and physical attacks, against our staff or anyone else;
• output from automated scanners with no demonstrated impact, and missing best-practice settings with no demonstrated risk;
• sending bulk or automated bookings or enquiries. Each real booking creates a calendar event and sends email to people. If you must test the forms, send a small number of requests, clearly labelled as security testing, and tell us.

4. Rules for researchers, and our commitment

We authorise good-faith security research on the systems in scope, on these conditions:

• use the least access needed to show that a vulnerability exists, and do not copy, change or delete data beyond that;
• if you reach personal data or credentials, stop at once, tell us, and do not look further;
• delete any data you obtained once you have reported, and do not share it with anyone;
• do not disrupt the service or other people's use of it; and
• report promptly, and keep the details private until clause 2 allows otherwise.

If you follow these conditions and report promptly, the Company will not bring legal action against you or ask the police to investigate you for that research, and it regards your access to the systems in scope, within these conditions, as authorised by the Company for the purposes of the Computer Misuse Act 1990. This commitment has limits. The Company can authorise access only to systems it controls. It cannot authorise access to anyone else's systems or to other people's personal data, and it cannot bind the police, prosecutors, regulators or other third parties. It does not cover anything outside these conditions.

5. How the website is built

The website is a static site served by Vercel. It has no user accounts and no database of its own. Bookings and enquiries go to the service at api.scoutagency.uk, which checks the origin of each request, limits how often one address can send requests, and verifies the bot check on the server before it books or sends anything. The site sends a strict content security policy, HTTP Strict Transport Security and other security headers, and loads no third-party script except the Cloudflare Turnstile bot check, and only when a form is sent.

The Company holds no certification to a security standard, such as ISO/IEC 27001 or SOC 2, and makes no such claim.

6. Contact

Send security reports to legal@scoutatlas.uk. If a report concerns a breach of personal data, we handle it under our incident procedure, which includes telling the Information Commission within 72 hours where the law requires.