Vulnerability Disclosure

Contact us privately.

Email contact@baselayersecurity.com with the subject Security vulnerability report.

This page covers potential vulnerabilities in BaseLayer-operated websites and services. For a finding in a customer’s application or assessment, use the reporting channel agreed with that customer.

Keep the initial report concise. Do not email passwords, API keys, session tokens, personal data or unredacted customer information. If more sensitive evidence is needed, ask us to agree an appropriate transfer method first.

Help us reproduce the issue.

• The affected URL, service or feature.
• A description of the issue and its potential security impact.
• Clear steps to reproduce it, using your own account and test data.
• Redacted screenshots or a minimal proof of concept, if available.
• When you observed the issue and how we can contact you.

Protect people and their data.

This reporting page does not grant permission to test systems or access data. Only investigate within access and testing permissions you already hold.

• Use your own accounts and data. Do not access, change or download someone else’s information.
• If you encounter sensitive information unexpectedly, stop and report what you observed without collecting more.
• Avoid service disruption, destructive actions, social engineering and high-volume testing.
• Do not use a finding to gain continued access or move into other systems.

Give us room to investigate.

Please keep the details private while we review the report and coordinate next steps with you. Avoid posting exploit details or sensitive evidence publicly before we have discussed remediation and disclosure.

We may ask for clarification or additional reproduction details. Any publication timing or researcher acknowledgement should be agreed directly with our team.

For a non-security enquiry, use our early-access form or Security Services page.