01
Receipt
We receive your report through our dedicated security channel and request that all related communication remains confidential.
Security / Coordinated disclosure
Security is a shared signal.
DarkRisk welcomes responsible vulnerability reports. This centre explains how to report an issue, what responsible testing looks like, and what to expect from us.
Reporting channelOpen
[email protected] ↗Include the affected asset, impact, reproducible steps, and supporting evidence. Policy effective 1 August 2026.
Our commitment
DarkRisk (Pty) Ltd is committed to safeguarding its systems and the information entrusted to us by customers, partners, employees, and users. We recognise the important role independent security researchers play in strengthening the technology ecosystem.
When we receive a legitimate report submitted in accordance with this policy, we will assess it in good faith, assign appropriate resources, and work to address confirmed issues as quickly as reasonably possible.
Good-faith research that follows this policy will be treated as authorised security research. DarkRisk will not pursue legal action against a researcher solely for that compliant activity.
02 / Report
Send us the signal.
If you believe you have identified a vulnerability in a DarkRisk-owned asset or need to report a security incident, email:
[email protected]Helpful evidence
Affected URL or asset, impact, reproduction steps, screenshots, and relevant request or response details.
Please exclude
Unredacted credentials, unnecessary personal information, or data belonging to another customer or user.
03 / Guidelines
DO / GOOD FAITH
Protect people first.
- Test only systems and accounts you own or are explicitly authorised to use.
- Stop immediately if you encounter personal information, credentials, or customer data.
- Use the minimum interaction needed to demonstrate the vulnerability.
- Report findings promptly, clearly, and without conditions attached.
- Allow DarkRisk reasonable time to investigate and remediate before disclosure.
DO NOT / OUT OF BOUNDS
Avoid harm and disruption.
- Exfiltrating, retaining, changing, destroying, or publicly exposing data.
- Social engineering, phishing, physical intrusion, or targeting our personnel.
- Denial-of-service testing, traffic flooding, spam, or resource exhaustion.
- Automated scanning that degrades service or generates excessive traffic.
- Pivoting beyond the first vulnerability or weakening additional security controls.
Third-party services are outside the scope of this policy unless DarkRisk expressly confirms otherwise. This is a disclosure programme, not a paid bug bounty programme; rewards are not guaranteed.
04 / Process
What happens next.
02
Verification
Our security team reviews the evidence, reproduces the issue where possible, and establishes its scope and severity.
03
Remediation
We work to correct the issue or deploy appropriate mitigations, prioritising the protection of customers and users.
04
Communication
We aim to keep the reporter informed as the investigation progresses and confirm when the issue has been addressed.
We appreciate researchers who give us the opportunity to improve our products and better protect the organisations that rely on DarkRisk. Thank you for working with us constructively.