Skip to content
Responsible vulnerability disclosure

Security Policy

Help us protect our website and its visitors. Report security concerns responsibly and coordinate with us before testing.

Last updated: October 19, 2026 · SavvyTech LLC

1. Purpose

SavvyTech LLC welcomes reports of security vulnerabilities affecting its public website. Clear, responsible reports help us protect visitors and improve our services.

This policy explains where to report an issue, what information to include, and the limits on security testing. It is a vulnerability disclosure policy, not a customer service agreement, privacy policy, or general authorization to test systems.

2. Report a vulnerability

Email security@savvytechllc.com with the subject Security report: [brief description].

Include the following information when available:

  • The affected hostname, page URL, and relevant feature.
  • A clear description of the issue and its potential security impact.
  • Minimal steps to reproduce it, using accounts and data you own.
  • Relevant request and response excerpts, timestamps with time zone, and redacted screenshots or a minimal proof of concept.
  • Any testing already performed and whether sensitive information was encountered.
  • Your preferred contact details, or a request to remain anonymous.

English is preferred. Anonymous reports are welcome, although updates require a working reply address.

Do not email passwords, active tokens, private keys, customer records, malware, or full data dumps. For sensitive evidence, first send a brief description and request an appropriate transfer method. Standard email is not an encrypted reporting channel.

3. Scope and ownership

We accept reports concerning the public website at the following hostnames, to the extent the affected functionality is owned and controlled by SavvyTech LLC:

  • savvytechllc.com
  • www.savvytechllc.com

These hostnames identify reportable assets. They do not provide blanket permission for active testing.

Excluded unless separately authorized in writing

  • Other subdomains, IP addresses, origin infrastructure, internal networks, administrative interfaces, VPNs, and employee devices.
  • Customer environments and data, including systems SavvyTech LLC supports, administers, or consults on.
  • Email accounts, email routing infrastructure, DNS providers, hosting platforms, content delivery networks, and other third-party infrastructure.
  • Microsoft 365, Google Workspace, AWS, Azure, Google Cloud, payment services, and other vendor-operated services.
  • Linked websites, embedded third-party services, and systems belonging to partners or suppliers.

A business relationship, shared IP address, DNS record, or link from our website does not establish testing permission. Report third-party product issues through the relevant provider's disclosure process. If ownership is uncertain, contact us before testing.

4. Testing permission

Request written permission before active security testing. Your request should describe the exact assets, methods, timing, and expected traffic. Proceed only after receiving explicit written approval from an authorized SavvyTech LLC representative.

Publishing this policy, a security.txt file, or a Hall of Fame page does not itself authorize penetration testing, exploitation, scanning, or attempts to bypass access controls. Silence or an automated email response is not approval.

If you notice an issue during ordinary use, stop once you have enough information to describe it and report it. Do not expand access or attempt further exploitation to demonstrate impact.

Any written authorization applies only to its stated scope and conditions. SavvyTech LLC does not grant permission on behalf of customers, vendors, or other third parties. This policy provides no blanket legal safe harbor or immunity.

5. Research conduct and limits

All approved testing must follow the written authorization and these safeguards:

  • Use the least intrusive method and only the minimum evidence needed to establish the issue.
  • Use accounts and test data you own or have explicit permission to use.
  • Avoid disruption, resource exhaustion, changes to production data, or interference with other users.
  • Stop immediately if testing causes unexpected impact or exposes information belonging to someone else.
  • Keep findings and evidence private while coordinating remediation.

Prohibited activities

  • Denial-of-service, distributed denial-of-service, load or stress testing, high-volume scanning, and email or form flooding.
  • Phishing, social engineering, impersonation, physical intrusion, or contacting customers or staff to obtain access.
  • Password spraying, credential stuffing, brute-force attacks, or use of stolen or leaked credentials.
  • Installing malware, persistence, backdoors, or remote access tools.
  • Deleting or altering data, retrieving unnecessary records, moving laterally, or using a vulnerability to access additional systems.
  • Extortion, threats, or conditioning nondisclosure on payment.

6. Sensitive information

If you encounter personal, financial, health, authentication, confidential business, or customer information, stop testing immediately and notify us. Do not inspect additional records, download collections of data, or contact affected individuals.

Describe the exposure without copying the underlying sensitive information. Redact evidence, restrict access to it, and request instructions for secure handling and deletion. Do not publish or share sensitive evidence.

We use report details to assess, investigate, and address the issue. Relevant information is shared with personnel or providers involved in that work, or when required by applicable obligations. Request anonymity if you do not want public attribution. Do not submit information you are not entitled to share.

7. Review and response

We aim to acknowledge actionable reports, assess their impact, and coordinate appropriate remediation. This reporting channel is not a continuously staffed emergency service. We do not promise a fixed response or remediation deadline.

  1. Review: We examine the affected asset, evidence, and reproducibility.
  2. Clarify: We request additional details when needed. Any retesting requires explicit permission.
  3. Prioritize: We consider exploitability, business impact, affected data, and existing protections.
  4. Address: We determine the appropriate fix, mitigation, or vendor referral.
  5. Coordinate: We provide relevant updates when practical and discuss recognition or disclosure.

If you have not received a reply after seven business days, send a follow-up in the same email thread. This is a suggested follow-up interval, not a service-level commitment.

8. Report quality and prioritization

We prioritize reproducible issues with a credible impact on confidentiality, integrity, or availability, such as unauthorized access, exposed secrets, injection, or a demonstrated access-control failure.

The following usually receive lower priority unless evidence shows a meaningful security impact:

  • Scanner output or software version notices without a reproducible vulnerability.
  • Missing security headers, cookie attributes, or configuration recommendations without a demonstrated attack path.
  • Public information, intended behavior, or cosmetic and usability issues.
  • Issues limited to unsupported software or a researcher's own modified device.
  • Duplicate reports or vulnerabilities already under investigation.

A low-priority finding is not permission to attempt more intrusive exploitation. Share the evidence you already have and ask before conducting further validation.

9. Coordinated disclosure

Please give us a reasonable opportunity to investigate and address a reported issue before publishing technical details. Contact us to agree on a disclosure date and the information suitable for release. There is no automatic publication deadline under this policy.

If coordination stalls, explain your concern in the existing report thread. A recognized vulnerability coordination organization is another route for resolving disclosure concerns.

Do not publish personal information, customer data, credentials, or exploit details that place others at unnecessary risk. Reports affecting a third-party product should also be coordinated with the relevant vendor.

10. Recognition and rewards

With the researcher's permission, we consider public acknowledgment for original, actionable reports that help resolve a verified vulnerability. Recognition is discretionary and considers report quality, impact, cooperation, and compliance with the applicable testing authorization.

Approved acknowledgments appear on our Security Hall of Fame. Tell us your preferred display name and whether you want a profile link included. Anonymous reporting and private acknowledgment are welcome.

This is not a paid bug bounty program. Submitting a report does not create an entitlement to payment, gifts, employment, or public recognition.

11. Policy updates and contact

This policy applies to vulnerability reporting for the assets described above. Separate written testing agreements govern the activities they expressly authorize. This policy does not amend customer contracts or authorize access to customer systems.

We review this policy as our website and reporting process change. Review the current version before requesting testing permission. Updates do not expand any existing written authorization.

Security contact: security@savvytechllc.com
Machine-readable contact details: security.txt
Researcher acknowledgments: Hall of Fame