Security

Vulnerability Disclosure Policy

We take the security of goalsly.co.uk seriously. If you believe you've found a security vulnerability, we'd like to hear from you.

How to report a vulnerability

Please report any security issues directly to us by email. We ask that you do not publicly disclose the issue until we've had a reasonable opportunity to investigate and address it.

Send your report to [email protected] with as much detail as possible, including steps to reproduce the issue, the potential impact, and any supporting evidence.

We aim to acknowledge all reports within 3 business days and will keep you updated as we investigate.

What we ask of you

🔒
Don't access or modify data that isn't yours Limit your testing to your own accounts and data only.
🤝
Give us time to fix it before disclosing Please allow us reasonable time to resolve the issue before any public disclosure. We'll work as quickly as we can.
📋
Provide enough detail to reproduce Clear steps, screenshots, and a description of the expected vs. actual behaviour help us triage quickly.
🚫
No automated scanning without permission Please don't run automated vulnerability scanners against our site without prior agreement.

What you can expect from us

We will acknowledge your report promptly, keep you informed of our progress, and let you know when the issue has been resolved. We won't take legal action against researchers who act in good faith and follow this policy.

Goalsly is a small, independent product. We don't currently offer a bug bounty programme, but we genuinely appreciate responsible disclosures and will always credit researchers who help us improve security if they wish to be acknowledged.

Out of scope

The following are generally considered out of scope for this policy:

  • Theoretical vulnerabilities without a working proof of concept
  • Issues in third-party services we use (e.g. Stripe, Google Fonts)
  • Denial of service attacks
  • Social engineering or phishing attacks targeting Goalsly staff
  • Missing HTTP security headers that do not present a direct exploitable risk
  • Reports from automated scanners without manual verification

Canonical disclosure file

Our machine-readable security contact information is available at /.well-known/security.txt in line with RFC 9116.