Security Policy and Coordinated Disclosure

Last updated: October 27th, 2026

We want to hear from security researchers, and we want to make it safe to tell us. This policy says what you may test, how to report it, what we commit to, and what we will not do to you if you act in good faith.

Machine-readable contact details: /.well-known/security.txt.

1. How to report

Email security@lasthourhosting.org. Encrypt to our key if you prefer — ask and we will send it, or contact us at lasthourhosting.org/contact. Please include:

• what you found, and why it matters (one paragraph, plain language);
• the exact URL or endpoint, with the request you sent;
• steps to reproduce, or a proof-of-concept that does not damage anything;
• when you found it, and whether you have told anyone else.

Please do not include real customer data in a report. Use your own test account.

2. What we commit to

Stage	Our commitment
Acknowledgment	Within 2 business days
Initial assessment and severity	Within 5 business days
Fix for critical issues	Target 72 hours from confirmation
Fix for high-severity issues	Target 14 days
Fix for everything else	Next scheduled release, and we will tell you when
Credit	We will credit you by name (or anonymously, if you prefer) once a fix ships, unless you ask us not to
Updates	We will tell you what we fixed and when, and we will not go quiet on you

There is no bug bounty programme at this time. We will not pay for a report, and we will say so honestly rather than imply otherwise.

3. Authorised testing and safe harbour

If you act in good faith and follow this policy, we will not bring a civil claim, a criminal complaint, or a DMCA § 1201 anti-circumvention claim against you for your research. We consider your activity authorised under the Computer Fraud and Abuse Act and equivalent laws, and we will say so in writing if a third party (including a payment processor, a customer, or law enforcement) asks.

“Good faith” means you:

• test only systems you are authorised to test under section 4;
• do not access, modify, exfiltrate, or retain real customer data, and stop and report immediately if you encounter any;
• do not degrade, interrupt, or deny service to anyone;
• do not use social engineering, phishing, or physical intrusion against our staff or customers;
• do not test a third-party service we use, unless that provider's own policy allows it;
• give us a reasonable time to fix the issue before publishing anything, and coordinate the disclosure date with us (we aim for 90 days from your report, shorter if it is being exploited);
• do not extort us, demand payment, or threaten disclosure to force a payment — that is not research.

4. Scope

In scope:

• lasthourhosting.org and its subdomains
• my.lasthourhosting.org (customer portal and API)
• our published open-source code (test it in your own environment, not against production)

Out of scope — please do not test these, and reports about them will be closed:

• any service belonging to a customer of ours (their sites are their responsibility; report abuse to abuse@lasthourhosting.org instead);
• third-party services we use, including payment processors, our CDN, and our DNS provider;
• denial-of-service, volumetric, or load testing of any kind;
• dependency version banners without a demonstrated impact;
• missing security headers, cookie flags, or TLS configuration on their own, without an exploit path;
• SPF, DKIM, or DMARC reports, and email spoofing of our domains, which we already monitor;
• automated scanner output with no validation;
• rate-limiting or brute-force findings that require sustained attack traffic;
• clickjacking on pages with no state-changing action;
• social engineering, phishing simulations, and physical access attempts;
• self-XSS, and issues that require the victim to paste code into their own console;
• logout CSRF, and tabnabbing;
• software versions that are outdated but patched elsewhere in our stack.

5. If you are not sure

Ask first: security@lasthourhosting.org. We would rather answer a question than have you guess and stop. We answer scope questions within 2 business days.

6. What we do with reports

We keep a private register of reports, the fix, and the timeline. We publish an annual summary of how many reports we received, how many were valid, and our median time to fix. We do not publish individual reports without the reporter's agreement before the coordinated disclosure date.

7. Our own security practices

What we actually do is in section 7 of the Privacy Policy. In summary: TLS everywhere with HSTS on the portal, memory-hard password hashing, two-factor authentication available on every account, individual named staff access with logging, a defined patching schedule, and tested restores.

8. Changes

We may update this policy. The version at this URL and the date above is the one that applies.