Security and disclosure.
If you have found a weakness in this website or in a system run by one of the group’s companies, we want to hear from you first. This page says how to reach us, what we ask of you and what you can expect from us.
In short
- Last updated
- 2026-10-12
- Report to
- contact@hugosecurity.net
- Subject line
- Security
- Acknowledgement
- within 5 business days
- Disclosure window
- 90 days from acknowledgement
- Safe harbour
- yes, for good-faith research within these terms
- Bounty
- no
- security.txt
- /.well-known/security.txt
How to report
Email contact@hugosecurity.net with “Security” in the subject line. Describe what you found, where, and how to reproduce it. A PGP key is available on request, and this page is referenced from /.well-known/security.txt. We acknowledge receipt within five business days.
What we ask
Good-faith research is welcome. We ask that you:
- Do not access, modify or exfiltrate data that is not your own beyond what is needed to demonstrate the issue.
- Do not degrade the service for others – no denial of service, no spam, no social engineering of staff.
- Give us 90 days from acknowledgement before publishing, or longer if we agree a fix needs it.
What you can expect
We will not pursue legal action against researchers who follow the terms above. We keep you informed of progress, credit you if you wish once the issue is fixed, and publish an advisory where users of an affected system need to act. We do not run a bounty programme.
This website
hugosecurity.net is a static site served from a server the company operates: TLS only, HSTS, a strict content-security policy, no third-party code, no cookies. The server is patched within 72 hours of a security release.