1. REPORTING
1.1 Customers and researchers may confidentially report suspected vulnerabilities in Hostly-controlled websites, panels or services through authenticated support tickets, clearly marking the report as a security disclosure.
1.2 Reports should include a reproducible description, affected component, estimated impact, and supporting non-sensitive evidence. Do not send credentials or unrelated customer data.
2. AUTHORIZATION AND RESTRICTIONS
2.1 Publishing this policy does not authorize testing of production systems or access to third-party accounts. Written permission and a documented scope are required before active security testing not otherwise explicitly allowed.
2.2 Do not perform destructive testing, denial-of-service, credential stuffing, privilege escalation against other accounts, social engineering, malware deployment or data exfiltration.
2.3 Stop testing and promptly report if personal information or another customer's data is inadvertently exposed.
3. HANDLING
3.1 Hostly may triage reports, request additional details and remediate according to assessed risk and operational priorities. No guaranteed response or remediation period is created.
3.2 Hostly does not promise rewards, immunity from applicable law, or public attribution absent a separate written agreement.
3.3 Coordinated public disclosure should be discussed with Hostly first to reduce risk to customers; this does not prevent legally protected reporting to competent authorities.
CONTACT
For service questions, submit an authenticated ticket in the customer panel.
HOSTLY US, LLC 1209 MOUNTAIN ROAD PL NE STE N ALBUQUERQUE, NM 87110 UNITED STATES