Security

Responsible disclosure policy

If you find a security weakness in Simblia, please tell us. We'll work with you to fix it, and we won't take legal action against good-faith research that follows this policy.

Scope

simblia.com and its subdomains, and the Simblia platform once it's live.

How to report

Email security@simblia.com with a description, the steps to reproduce it and the impact you see.

Please don't

• Access, change or delete data that isn't yours, or keep more than you need to show the issue.
• Disrupt the service, send spam, or use social engineering against our staff or customers.
• Test against schools, pupils or other customers' accounts.
• Share the issue publicly before we've fixed it or agreed a date with you.

What we do

• Confirm we've received your report within 3 working days.
• Keep you updated while we investigate and fix it.
• Aim to fix critical issues within 72 hours and high-severity issues within 14 days.
• Credit you on this page, if you want.

We don't offer paid bounties at this stage. Our security.txt lists the same contact.