Reporting a security issue

How to report

Email security@designsenselms.com. Please include enough for us to reproduce the issue: the URL or endpoint, the steps you took, and what you saw that you should not have. A short screen recording is often faster than a written description.

If you would rather not reveal a working exploit in a first email, describe the class of issue and the affected surface, and we will reply with somewhere to send the detail.

What is in scope

The designsenselms.com website and its API, our Discord bot’s behaviour within the DesignSense server, and the credential verification pages.

We are most interested in anything that lets someone reach another person’s account or data, take a paid enrolment without paying for it, alter a grade or an exam result, or issue or forge a certificate or License.

What is out of scope

Denial of service and load testing of any kind. Social engineering of our staff, instructors or students. Physical security. Findings that depend on a compromised device or a browser extension already installed by the victim.

Reports consisting only of automated scanner output — a missing header, a version banner, a rate limit you did not test — are not usually actionable on their own. If you can show real impact, show it, and we will treat it as a real finding.

Rules of engagement

Test against accounts you created yourself. Do not access, modify or download another person’s data, and stop as soon as you have confirmed the issue exists — proving you can read one record is enough, and you do not need the rest.

Do not alter or delete anything you did not create, and do not use a finding to grant yourself access, credit, a credential or a discount. Give us a reasonable chance to fix the issue before you publish, and we will agree a date with you rather than ask you to wait indefinitely.

What we will do

We will acknowledge your report, tell you whether we have reproduced it, and let you know when it is fixed. We are a small team, so please allow a few days for a first reply rather than assuming it went unread.

We do not currently run a paid bug bounty. We are glad to credit you by name on the fix if you would like that, and to say so in writing if it is useful to you.

Safe harbour

If you follow the rules above, we will treat your testing as authorised, we will not pursue legal action over it, and we will not report it as an attack. If a third party brings a claim about research that stayed within this policy, we will make clear that it was authorised.

This protection covers your own testing. It does not extend to anything done to another person’s account, to data you kept or shared, or to activity outside the scope described here.

Contact