VUL­NERA­BILITY DISCLOSURE

Rynua Interactive treats the security of its systems, and of the data entrusted to them, as a standing obligation. If an independent researcher identifies a genuine weakness and discloses it to us responsibly, we want to know.

This policy defines the systems on which we authorise security testing, the conditions that apply, how to report a finding, and what you can expect from us in return. It is limited authorisation on the terms below, not a general invitation to test Rynua systems.

Scope

This policy authorises security testing against the following, and nothing else:

• The public website at www.rynua.com, and the pages it serves
• The careers application, contact and job-alerts flows served from that domain

That list is exhaustive. Any other host, subdomain, service or endpoint is outside this policy — including anything you discover that is not named above, and any system operated by our suppliers, such as our hosting, content management, storage, email and infrastructure providers. Testing anything outside this scope is not authorised. If you believe a Rynua system not listed here carries a vulnerability, report it without testing it.

Prohibited activity

The following are prohibited under this policy regardless of intent, and engaging in them forfeits the protection set out below:

• Denial-of-service or load testing, and anything else that degrades availability or performance for other people.
• Accessing, modifying, exfiltrating, retaining, or deleting data belonging to anyone else. If you encounter personal or confidential data while testing, stop, do not copy or retain it, and report the issue.
• Social engineering, phishing, or pretexting directed at our staff, contractors, suppliers, or community.
• Physical attempts against premises, hardware, or personnel.
• Attacks that depend on a compromised account, a man-in-the-middle position, or physical access to a device.
• Automated scanning at a rate or volume that affects service for others.
• Publishing, sharing, selling, or otherwise disclosing a vulnerability to another party before we have resolved it, unless we have agreed otherwise with you in writing.

Submitting a report

Send reports to security@rynua.com. Tell us which system is affected, what you observed, the steps required to reproduce it, and enough detail for us to investigate without asking you to repeat risky testing. Please include any relevant request or response details, screenshots, or proof-of-concept material that can help us reproduce the issue. Do not include personal data or confidential information unless it is necessary to explain the vulnerability.

We aim to acknowledge every report within three working days. Please give us a reasonable opportunity to investigate and resolve the issue before disclosing it elsewhere, and coordinate any disclosure with us.

Our commitment

If you make a good-faith report and keep your testing within this policy, we will treat that testing as authorised and will not pursue or support legal action against you in respect of it. We will not report your activity to law enforcement solely because you carried out testing authorised by this policy. This protection depends on your compliance with the policy and does not extend to activity outside its scope or to anything prohibited above.

You will receive a reply from someone able to act on the report, reasonable updates while the issue is being investigated, and confirmation when it is closed. We do not operate a paid bug-bounty programme at this time. Where appropriate and with your permission, we may credit you publicly for the finding.

What this site collects, and why, is set out in the privacy policy. Anything that is not a security report belongs in the contact form.