Responsible Disclosure
If you believe you have found a security vulnerability affecting PNTMAP™, we want to hear from you before anyone else does.
PNTMAP is an intelligence and situational-awareness service. It is not an authorised navigation source and must not be used as the sole basis for flight planning, navigation or aviation safety decisions.
How to report
Email security@decentcybersecurity.eu with a description of the issue, the affected URL or endpoint, and the steps needed to reproduce it. Please do not open a public issue or post details publicly before we have responded.
Our commitments
We acknowledge reports within 3 working days, provide an assessment within 10 working days, and keep you informed until the issue is resolved. We will credit reporters who wish to be named. We will not pursue legal action against researchers who act in good faith under this policy.
In scope
pntmap.co.uk and its public API endpoints, the ingest endpoint, and the published web application.
Out of scope
Denial-of-service testing, physical attacks on sensor hardware, social engineering of staff, automated scanner output without a demonstrated impact, and issues in third-party services we do not control.
Rules
Test only against your own data. Do not access, modify or exfiltrate other users' data, do not degrade the service, and do not interfere with sensor telemetry.