Vulnerability Disclosure Policy

Hipposerve® Digital Services Ltd
Effective Date: 26 October 2026
Policy Version: 1.0

1. Introduction

At Hipposerve®, the security, privacy and reliability of our services are fundamental to the trust our customers place in us.

We recognise the important contribution that independent security researchers, ethical hackers and members of the wider security community make towards identifying vulnerabilities and improving internet security.

We welcome responsible reports of potential security vulnerabilities affecting systems and services operated by Hipposerve.

This Vulnerability Disclosure Policy explains how to report a security concern, which systems are within scope, what activities are permitted, and how we will respond.

Our aim is to encourage responsible disclosure while protecting our customers, their data and the availability of our services.

2. Reporting a Security Vulnerability

If you believe you have identified a security vulnerability affecting Hipposerve, please contact our security team:

Email: security@hipposerve.com
Subject: Security Vulnerability Report

Please include as much relevant information as reasonably possible:

• A description of the suspected vulnerability.
• The affected website, service, application or system.
• Steps required to reproduce or demonstrate the issue.
• The potential security impact.
• Relevant screenshots, logs or supporting technical information, where appropriate.
• Your contact details if you would like to receive updates.

Please do not include passwords, personal information, customer records or other sensitive data unless specifically requested through an agreed secure communication channel.

If you believe the vulnerability is being actively exploited or presents an immediate threat, please indicate URGENT SECURITY REPORT in the subject line.

3. Scope of This Policy

This policy applies to security vulnerabilities affecting systems and applications owned or directly operated by Hipposerve, where investigation can be conducted without accessing customer-owned resources or disrupting services.

Examples of potentially in-scope systems include:

• Hipposerve's primary website at hipposerve.com.
• Hipposerve-operated customer account and billing interfaces.
• Hipposerve-developed applications and management interfaces.
• Authentication and account management functionality operated by Hipposerve.
• Publicly accessible APIs developed and operated by Hipposerve.

Inclusion in this list does not constitute blanket authorisation to conduct penetration testing, automated vulnerability scanning or intrusive security assessments.

Testing must remain within the permitted activities described in this policy.

Where the ownership or scope of a system is unclear, researchers should contact Hipposerve before proceeding.

4. Systems and Activities Outside Scope

As a hosting and digital services provider, Hipposerve operates infrastructure that supports websites, applications and services belonging to independent customers.

Protecting these customers is particularly important.

The following are explicitly excluded from authorised security testing under this policy:

• Customer-owned websites, applications, databases and email accounts.
• Customer-managed VPS instances and reseller hosting environments.
• Customer WordPress installations, plugins, themes and custom applications.
• Third-party services, platforms and infrastructure not owned by Hipposerve.
• Internal administrative systems and non-public management interfaces.
• Network infrastructure, hosting servers and IP addresses unless Hipposerve has provided explicit written authorisation.
• Any system where testing could affect another customer's service, security or data.

Hosting a website or service with Hipposerve does not grant third parties permission to conduct security testing against that website or service.

Researchers identifying potential vulnerabilities affecting customer-hosted services are encouraged to report their concerns without undertaking further testing.

Hipposerve may assist with forwarding appropriate reports to the affected customer or relevant service provider.

5. Responsible Security Research

We ask researchers to act responsibly, proportionately and in good faith.

Researchers must:

• Make reasonable efforts to avoid disrupting systems or services.
• Limit their investigation to the minimum activity necessary to identify and describe a potential vulnerability.
• Stop testing immediately if personal information, customer data or confidential information becomes accessible.
• Avoid modifying, deleting, downloading or disclosing information belonging to others.
• Report identified vulnerabilities promptly.
• Respect the privacy and security of Hipposerve customers and employees.
• Obtain explicit written permission before undertaking intrusive testing.

The following activities are not authorised:

• Denial-of-service attacks, including distributed denial-of-service attacks.
• Automated mass scanning, aggressive enumeration or high-volume security testing.
• Social engineering, phishing or impersonation.
• Password spraying, credential stuffing or brute-force attacks.
• Exploitation of vulnerabilities to obtain elevated privileges or persistent access.
• Installation of malware, backdoors or other unauthorised software.
• Accessing, extracting or modifying customer or company data.
• Physical security testing.
• Actions that could impair service availability, integrity or confidentiality.

Researchers should not attempt to demonstrate the full impact of a vulnerability where doing so would create additional risk.

6. Our Response to Vulnerability Reports

Hipposerve takes legitimate security reports seriously.

When we receive a report, we aim to:

1. Acknowledge receipt: Within two working days where reasonably practicable.
2. Review and assess: Determine whether the reported issue is reproducible, within scope and presents a genuine security risk.
3. Prioritise remediation: Assess the severity, potential impact and appropriate corrective action.
4. Provide updates: Communicate meaningful progress where appropriate and reasonably possible.
5. Confirm resolution: Inform the reporting researcher when an issue has been addressed, where appropriate.

These are operational targets rather than guaranteed response or resolution times.

Some vulnerabilities may require coordination with upstream software vendors, infrastructure providers or other third parties.

In such circumstances, remediation times may depend on the availability of vendor updates or other security measures.

Where an immediate software fix is unavailable, Hipposerve may implement temporary mitigations to reduce the risk while awaiting a permanent resolution.

7. Coordinated Disclosure

We support coordinated vulnerability disclosure.

Researchers are requested to keep vulnerability details confidential while Hipposerve investigates and addresses the issue.

Please do not publicly disclose technical details, proof-of-concept exploits or information that could facilitate exploitation without first coordinating with our security team.

Where appropriate, Hipposerve will discuss a reasonable disclosure timeline with the researcher, taking account of:

• The severity of the vulnerability.
• The potential impact on customers.
• The availability of patches or mitigations.
• Any necessary coordination with third-party vendors.

We recognise the value of responsible public disclosure and will not unreasonably withhold communication about resolved vulnerabilities.

However, protecting affected systems and customers will remain our primary consideration.

8. Good-Faith Research and Legal Considerations

Hipposerve supports legitimate, good-faith security research conducted in accordance with this policy.

We do not intend to initiate legal action solely because a researcher responsibly reports a vulnerability discovered through activity that we have expressly authorised.

However, this policy does not grant unrestricted permission to access or test our systems.

It does not provide immunity from applicable laws, including the Computer Misuse Act 1990, nor does it authorise activities affecting third-party systems or customer resources.

Hipposerve cannot provide authorisation on behalf of customers, software vendors or other infrastructure providers.

Researchers remain responsible for ensuring their activities are lawful and within the scope of any permission granted.

9. Recognition and Rewards

Hipposerve appreciates the contribution of security researchers who responsibly disclose vulnerabilities.

We may, at our discretion, acknowledge researchers who have made a meaningful contribution to improving our security, subject to their consent.

Hipposerve does not currently operate a public bug bounty programme.

Submission of a vulnerability report does not create an entitlement to payment, compensation, services or other rewards.

Any recognition or reward is entirely discretionary and must not be assumed.

10. Customer Security Vulnerabilities

If a vulnerability is reported in a customer-hosted website or application, Hipposerve may review the information and, where appropriate, notify the affected customer.

Responsibility for correcting vulnerabilities in customer-managed applications will generally remain with the customer, subject to the terms of their service and any applicable managed-service arrangements.

Where a vulnerability presents a material risk to other customers, shared infrastructure or the wider network, Hipposerve may take proportionate protective action in accordance with its Terms and Conditions and Acceptable Use Policy.

Such action may include applying security restrictions, implementing temporary mitigations or contacting affected parties.

11. Privacy and Confidentiality

Information submitted through the vulnerability disclosure process will be used for investigating, assessing and addressing reported security issues.

Reports may be shared with relevant internal personnel, service providers, software vendors or affected customers where reasonably necessary for investigation or remediation.

We will handle personal information in accordance with our Privacy Policy and applicable data protection legislation.

Researchers should avoid submitting unnecessary personal or confidential information.

12. Changes to This Policy

Hipposerve may update this policy periodically to reflect changes in our services, infrastructure, security practices or applicable requirements.

The latest version will be published on our website.

Continued publication of this policy does not constitute permission for activities outside its defined scope.

13. Contact and Further Information

For security vulnerability reports:

Security Team
Hipposerve® Digital Services Ltd
Email: security@hipposerve.com
Website: https://hipposerve.com

For general customer support or service-related enquiries, please use our normal support channels rather than the vulnerability reporting address.

Our machine-readable vulnerability disclosure information is available at:

https://hipposerve.com/.well-known/security.txt

Hipposerve® Digital Services Ltd
Registered in England and Wales
Company Registration Number: 10288860

Security is a shared responsibility. We appreciate the contribution of those who help us keep Hipposerve and our customers safer.