Skip to content

Responsible disclosure

Last updated 10 November 2026

If you find a security weakness in our website or services, please tell us. We’ll work with you to fix it and won’t take legal action against good-faith research that follows this policy.

How to report

Email security@arthiq.co with “Security” in the subject line. Please include:

  • a description of the issue and where it is (URL, system or component);
  • the steps to reproduce it, with proof-of-concept code or screenshots if you have them;
  • the impact you expect, and how you’d like to be credited.

Please don’t include personal data you may have accessed. This policy is also published at /.well-known/security.txt.

In scope

arthiq.si and its subdomains, and systems Arthiq operates directly. Systems running in a client’s own environment belong to that client. Report those to the client, or tell us and we’ll pass it on with your permission.

Out of scope

  • Third-party services we use, such as Cloudflare, Cal.com, Google and Railway. Please report those to the provider.
  • Findings with no realistic security impact, such as missing headers on static pages, banner or version disclosure, or clickjacking on pages with no sensitive actions.
  • Results from automated scanners that you haven’t verified.
  • Denial-of-service, physical attacks and social engineering.

Please don’t

  • Access, change, keep or delete data that isn’t yours. If you reach personal data by accident, stop, and tell us what you saw.
  • Do more than the minimum testing needed to show the issue.
  • Run denial-of-service tests, spam, or social engineering against our staff or clients.
  • Publish details before we’ve fixed the issue or 90 days have passed, whichever is sooner, unless we agree otherwise.

What we’ll do

  • Acknowledge your report within 2 business days.
  • Give you an assessment and expected fix date within 10 business days, and keep you updated.
  • Tell you when it’s fixed, and credit you publicly if you’d like. We don’t currently run a paid bounty.

Safe harbour

If you act in good faith and follow this policy, we consider your research authorised. We won’t take legal action against you or report you to law enforcement, and if a third party takes action against you over research that followed this policy, we’ll make it clear that you acted with our authorisation. This policy can’t authorise testing of systems that we don’t own, or activity that breaks the law.