Security Vulnerability Disclosure

If you discover a security vulnerability on lawnhq.co.uk, we kindly invite you to contact us at your earliest convenience. We review all legitimate reports and aim to resolve issues quickly. Before reporting, please review this document—including our fundamentals, bounty program, reward guidelines, and non-reportable issues.

Fundamentals

If you follow the principles below when reporting a security issue to lawnhq.co.uk, we will not initiate legal action or enforcement investigations against you in response to your report.

We ask that:

  • You give us reasonable time to review and fix the issue before disclosing it publicly or sharing it with others.
  • You do not interact with or access private accounts without the account owner's consent.
  • You make a good-faith effort to avoid privacy violations, service disruptions, or data destruction.
  • You do not exploit the issue for any reason, including to demonstrate further risks or access sensitive data.
  • You abide by all relevant laws and rules.

The Bounty Program

Security researchers who report vulnerabilities to help safeguard our platform are acknowledged and rewarded. Lawnhq.co.uk reserves the right to award prizes based on factors like impact, risk, and report quality.

To be eligible for a bounty, you have to:

  • Observe the above-mentioned principles.
  • Report a valid security bug that poses a risk to privacy or security.
  • Submit your report through our security center—please do not contact employees directly.
  • Please include any accidental privacy violations or disruptions in your report.
  • Understand that while we investigate all valid reports, priority is based on risk. A response may take some time.
  • Agree that we reserve the right to publish submitted reports.

Rewards

Rewards are based on the impact and severity of the vulnerability. Please provide detailed and reproducible steps in your report. If the issue cannot be reproduced, it is not eligible for a bounty.

  • The first valid report of an issue receives the bounty.
  • Multiple bugs caused by a single underlying issue are treated as one report.
  • We assess rewards based on impact, exploitability, and report quality.

The following are our current maximum reward amounts based on severity:

🛡️ Critical severity: – £200

Includes major issues like:

  • Remote Code Execution
  • Remote Shell or Command Execution
  • Vertical Authentication Bypass
  • SQL injection that leaks targeted data
  • Full account access

🔒 High Severity – £100.0

Includes issues such as:

  • Lateral authentication bypass
  • Disclosure of sensitive internal data
  • Stored XSS affecting other users
  • Local file inclusion
  • Insecure handling of authentication cookies

⚠️ Medium Severity – £50

Examples include:

  • Logic or business process flaws
  • Insecure object references

ℹ️ Low Severity – Recognition Only

Examples include:

  • Open redirects
  • Reflected XSS
  • Low-sensitivity information leaks

Contact Information

Address: 5 Neilson Rd, Gateshead NE10 0EW, United Kingdom

Email: contact@lawnhq.co.uk

Phone: +44 7446 439998