Vulnerability Disclosure Programme

Name: Vulnerability Disclosure Programme | Report a Security Issue
Brand: Red Eagle Tech
Rating: 5.0 (41 reviews)

Help us keep Red Eagle Tech secure - responsibly

Every company says they take security very seriously, but at Red Eagle Tech, we're about actions not words. So judge for yourself.

We know that no system is perfect. If you've discovered a potential security issue, we want to hear from you right away.

What's in scope?

Our VDP covers all Red Eagle Tech properties and services:

redeagle.tech and all subdomains
MeldEagle (meldeagle.com) - our Shopify automation platform
Content Disarm & Reconstruct API and related services
All other web-facing properties published by Red Eagle Tech

Not all our properties are listed here - some are bespoke client solutions, so we don't publicise them here. But they're all clearly identified as 'powered by Red Eagle Tech', so if you see our name, it's in scope.

Researchers that are keen to work with us and establish a trusted relationship are welcome to request a full list of properties and we can even help out with test environments. Our test environment architecture and code exactly mirrors production, whilst being free from sensitive data.

Out of scope: Third-party services we use but don't control, and theoretical "best practice" suggestions without demonstrable impact.

How to report a vulnerability

Spotted something that needs fixing? High five! Here's how to let us know:

Email us at: security@redeagle.tech

Please include:

What you found and why it matters
Steps to reproduce (the more detail, the better)
Screenshots, proof-of-concept code, or videos if helpful
The affected URL or system
Your thoughts on severity and potential impact

Need to encrypt your message?

Use our PGP public key

Fingerprint: C5AB 412E 4CAE 4CE3 ECB1 F9C9 E32E F95C 43A3 1BBD

Please don't share the vulnerability publicly yet - let's fix it together first

What we promise

Quick response
We'll acknowledge your report within 3 business days

Regular updates
We'll keep you informed as we investigate and fix

Coordinated disclosure
We'll work with you on when to go public

No legal action
Good faith research following our guidelines is safe

Recognition
Valid findings earn a spot in our Hall of Fame

Timeline expectations:

• Acknowledgment: Within 3 business days
• Initial triage: Within 10 business days
• Fix timeline: Varies by severity (we'll keep you posted)
• Disclosure: After fix, or 90 days max

Occasionally we might miss an email - sorry - we're human. If you haven't heard back, please give us a friendly nudge.

Ground rules for testing

Please do:

• Test responsibly and minimise impact
• Stop immediately if you encounter user data
• Report findings promptly
• Work with us on coordinated disclosure

Please don't:

• Launch denial-of-service attacks
• Use automated scanners that might overwhelm our systems
• Access, modify, or delete data that isn't yours
• Social engineer our staff (we're friendly, but that's cheating!)
• Test on production during peak hours if avoidable
• Share vulnerabilities before we've had a chance to fix them

Safe harbour - you're protected

We want you to feel safe reporting issues to us. Crystal clear:

If you follow these guidelines in good faith, we will NOT pursue legal action.

No threatening letters, no lawyers, just gratitude. Scout's honour.

If someone else gives you grief about your research (as long as you followed our rules), we'll confirm you had our permission. We've got your back.

Of course, deliberately malicious or exceptionally dumb actions aren't covered. But we know you're one of the good ones... so this doesn't apply to you does it.