Security and responsible disclosure

We will never ask you for a password, a one-time code or new banking details. Not by email, call, SMS, WhatsApp, voice note or video call, and not even if the request seems to come from someone you know at Armourware.

If you receive a request like that, don’t act on it, don’t reply and don’t use any link or number in it. Forward it to security@armourware.com. If you can’t forward it, send a screenshot and tell us how it reached you. If you’ve already shared a code or moved money, call your bank’s fraud line and your IT team first, then tell us.

To check a message really is from us, contact us on an address or number you already have, never one the message gives you. It’s the rule we teach: assess the ask, then ask.

If you think you’ve found a vulnerability in armourware.com or in email sent from our domain, email security@armourware.com with:

• what you found and where (the page, address or email);
• the steps to reproduce it;
• what an attacker could do with it.

We aim to acknowledge your report within five working days, keep you informed while we fix it, and credit you once it’s resolved if you’d like that. We don’t run a paid bug bounty.

In scope: armourware.com and its subdomains, and email sent from armourware.com and mail.armourware.com.

Out of scope: denial-of-service or volume testing, spam through the contact form, social engineering of our team or our clients, physical attacks, and the services we use (Vercel, Resend and Google), which have their own disclosure programmes.

• Use only your own accounts and data, and access no more than you need to show the problem.
• If you reach personal information, stop, don’t keep or share it, and tell us straight away.
• Don’t degrade the site for others, and don’t change or delete data.
• Give us a reasonable chance to fix the problem before you share it publicly, on a date we agree together.

If you follow these rules, we’ll treat your research as authorised and won’t take legal action against you for it.

Our security contact is also published in the standard format at /.well-known/security.txt.