Trust Portal
Vulnerability disclosure
How to tell us about a security weakness in LastAwarded, what is in scope, and what you can expect from us.
How to report
Write to us through the contact page. Say what you found, the address where you found it, the steps that show it, and what it let you reach. Please do not put anybody else's data in the report.
What is in scope
This site, lastawarded.com, and the member app at https://lastawarded.com/app/.
Out of scope: other people's accounts, attacks that stop the service for others, mail sent in bulk, tricking our people, and anything physical.
How to test
- Use only an account of your own.
- Stop as soon as you have shown the problem, and do not keep, change or delete data that is not yours.
- Give us time to fix it before you tell anybody else.
Safe harbour
If you act in good faith and keep to this policy, we treat your research as authorized and we will not take legal action against you for it. If somebody else does, we will make it known that you kept to this policy.
The rest of the Trust Portal
- Trust PortalWhat is true today, in one list.
- How data is keptWhere documents sit, who can read them, and what goes to an AI model.
- Access controlRoles, two-step sign-in, sessions and the account history.
- Backups and their encryptionWhat the nightly copy holds and how it is locked.
- Incident responseWhat we do when member data may have been reached.
- Outside servicesThe kinds of service that touch member data.
- Security questionnaireAsk for it, under a non-disclosure agreement.
- Security and privacyThe whole of what is stored, in one page.