A careful disclosure
starts with context.

Keep the scope clear

This route covers the corporate website on i-o.com and its explicitly authorised deployment. It does not extend testing permission to operating companies, customers, suppliers or unrelated systems.

This page is a reporting channel, not a bug-bounty programme, a reward offer or general authorisation to access systems. Obtain permission before testing outside ordinary use.

Minimise impact

Do not disrupt service, attempt denial of service, use social engineering, persist access, change another person’s information or retrieve data beyond what is necessary to identify the issue. If personal or confidential information becomes visible, stop and report the situation without copying it into the form.

Avoid publishing exploitation details while a report is being assessed. Any coordinated disclosure timing should be agreed after the issue and affected parties are understood.

Make it reproducible

• The affected hostname and path, the time observed and relevant browser or client details.
• A concise description of the suspected weakness and its practical impact.
• Minimal reproduction steps using your own account or non-sensitive example data.
• A way to contact you for clarification. Do not include working secrets, session tokens or stolen data.

Assessment and follow-up

The reviewer should verify scope, assess severity and involve the person responsible for the affected system. A submission reference confirms receipt, not validation of the vulnerability or a promised remediation date.

If the issue belongs to an operating business, use its disclosure channel. For active misuse of a service by a third party, use abuse reporting.