Security Vulnerability Disclosure Policy

Last Updated: 23 October 2026

At BEN DAWOOD, we take the security of our website, customer information, and online shopping services seriously. We are committed to maintaining a secure and trustworthy shopping environment for our customers.

If you believe you have discovered a potential security vulnerability affecting our website, we encourage you to report it responsibly so that we can investigate and take appropriate corrective action.

1. Purpose of This Policy

This Security Vulnerability Disclosure Policy outlines the procedures for reporting potential security weaknesses affecting BEN DAWOOD's online services.

We welcome responsible, good-faith vulnerability reports from security researchers, customers, and other individuals who help us improve the security of our website.

Our objectives are to:

  • Protect customer information and privacy.

  • Maintain the security and reliability of our website.

  • Identify and address potential security vulnerabilities.

  • Encourage responsible security reporting.

  • Minimise risks to customers and business operations.

2. Responsible Disclosure Guidelines

We ask individuals reporting potential vulnerabilities to follow these principles:

  • Report vulnerabilities promptly and responsibly.

  • Allow reasonable time for investigation and remediation before public disclosure.

  • Do not access, collect, download, or disclose private customer information.

  • Do not modify, delete, or compromise website data.

  • Do not attempt to gain unauthorised access to accounts, systems, or services.

  • Do not disrupt website functionality or availability.

  • Do not conduct phishing, malware distribution, or social engineering activities.

  • Avoid testing that could negatively affect customers or business operations.

  • Comply with all applicable laws and regulations.

We appreciate good-faith reports that follow these guidelines. However, this policy does not grant permission to access systems without authorisation or provide a blanket exemption from legal liability.

3. How to Report a Security Vulnerability

If you identify a potential security issue, please contact our support team:

Email: bendawood@sipports.co.uk

Please use the subject line:

Security Vulnerability Report – BEN DAWOOD

Where possible, include the following information:

  • The affected webpage or URL.

  • A clear description of the suspected vulnerability.

  • Steps necessary to reproduce the issue safely.

  • Supporting screenshots or technical evidence, where appropriate.

  • An explanation of the potential security impact.

  • Your contact information for follow-up communication.

Please do not include customer personal information, passwords, payment card details, or other sensitive information in your report.

4. Our Response Process

Upon receiving a vulnerability report, BEN DAWOOD will make reasonable efforts to:

  • Acknowledge and review the submitted report.

  • Assess the nature and potential severity of the issue.

  • Investigate and verify the reported vulnerability.

  • Coordinate with relevant technical or service providers where necessary.

  • Implement appropriate corrective measures where possible.

  • Communicate relevant updates to the reporting individual when appropriate.

Response and resolution times may vary depending on the complexity, severity, and nature of the reported issue.

5. Scope of This Policy

This policy covers security concerns relating to systems and services operated or directly controlled by BEN DAWOOD, including:

  • Our official e-commerce website.

  • Customer-facing website functionality.

  • Store-managed customer account features.

  • Order management and related website functions.

  • Security configurations under our direct control.

Security issues affecting services operated by independent third-party providers may need to be reported directly to the relevant provider.

6. Activities Outside the Scope

The following activities are not authorised under this policy:

  • Denial-of-service or distributed denial-of-service testing.

  • Automated vulnerability scanning that causes disruption or excessive traffic.

  • Phishing or social engineering.

  • Malware deployment or distribution.

  • Attempts to access customer accounts without permission.

  • Extraction, modification, or deletion of personal information.

  • Physical security testing.

  • Reports of theoretical vulnerabilities without a demonstrable security impact.

  • Testing third-party platforms or infrastructure without their express authorisation.

7. No Bug Bounty Programme

BEN DAWOOD does not currently operate a formal bug bounty or paid vulnerability disclosure programme.

We do not guarantee financial compensation, rewards, or other benefits for submitted reports.

Any acknowledgement or recognition is entirely voluntary and at our discretion.

8. Public Disclosure

We request that security researchers and reporting individuals refrain from publicly disclosing vulnerability details before the issue has been appropriately investigated and addressed.

Please coordinate any proposed public disclosure with BEN DAWOOD and obtain written agreement where appropriate.

Responsible coordination helps reduce potential security risks to customers and our services.

9. Confidentiality and Data Protection

Security reports should be handled confidentially and responsibly.

Individuals submitting reports must not disclose customer information, confidential business records, payment details, or other sensitive information obtained during vulnerability discovery.

Any personal information submitted as part of a report will be handled in accordance with our Privacy Policy and applicable UK data protection legislation.

10. Policy Updates

BEN DAWOOD reserves the right to update this Security Vulnerability Disclosure Policy to reflect changes in security practices, technology, or applicable legal requirements.

Any updates will be published on this page with a revised last-updated date.

11. Contact Information

For security-related enquiries or responsible vulnerability disclosures, please contact:

BEN DAWOOD

Business Address:
24 Swires Road
Bradford, BD2 4RS
United Kingdom

Email: bendawood@sipports.co.uk

Phone: +44 7868 244635

We appreciate responsible security reporting and your contribution to helping maintain a safe and secure shopping environment for our customers.