Found a hole? Tell us.

How to report

Email security@huttenlochertech.com with what you found, where, and the steps to see it. Screenshots or a short proof of concept help. It’s also in our security.txt.

• Within two business days you get a reply from a person, not a ticket robot.
• Within ten business days we tell you whether it’s real and what we’re doing about it.
• When it’s fixed we tell you, and, if you want, thank you by name below.

In scope

• huttenlochertech.com and its subdomains, including the client portal and the back office
• The VYVE platform: joinvyve.io, its subdomains, and the VYVE apps
• Cue: joincue.io, app.joincue.io and the Cue apps
• Client sites we build and host. Tell us the site; we’ll handle it with the owner.

Out of scope

• Denial of service, load testing, or anything that degrades a site for real users
• Social engineering, phishing or physical attempts on us, our clients or their staff
• Findings that need a rooted device, a compromised browser or physical access
• Reports from automated scanners with no demonstrated impact (missing headers on a page that holds nothing, version banners alone)
• Third-party services we use (report those to the vendor: hosting, payments, email)

Safe harbor

If you act in good faith under this policy, we consider your research authorized, we won’t take legal action against you or ask anyone else to, and if a third party does, we’ll make it known that you followed this policy. Good faith means:

• Only touch your own accounts and data. If you reach someone else’s, stop, don’t keep or share it, and tell us.
• Do the minimum needed to show the problem. No persistence, no pivoting, no destruction.
• Give us a reasonable chance to fix it before telling anyone else. We’ll agree a date with you, normally within 90 days.
• Don’t ask for payment as a condition of telling us.

We don’t run a paid bounty yet. Real findings get our thanks here, a reference if you want one, and our gratitude.

Thank you

No reports yet. The first researcher to find something real goes here.

Our own research

We report what we find in other people’s software the same way: privately to the maker, with time to fix it before anything is published. Found flaws in WordPress plugins and themes go through the established disclosure programs, and we only ever test our own installed copies, never a site we don’t run. Published results show up in our vulnerability database and advisories.

Huttenlocher Technologies LLC, Myrtle Beach, South Carolina. See also how we handle security.