Security & Responsible Disclosure

Raeburn Consulting welcomes good-faith security research. If you believe you have found a vulnerability affecting an in-scope system, please report it privately so we can investigate and coordinate remediation.

Incident response

Our public Incident Response Commitment explains our severity-classification, maintained response procedures, customer/regulatory assessment, evidence-preservation and post-incident-review principles without exposing sensitive operational playbooks.

Secure development lifecycle

Our production consulting website uses automated software-quality and security gates in GitHub Actions. The controls below are listed because they are implemented in the current repository and deployment verification workflow.

• Linting: the CI workflow runs the project lint command on pushes and pull requests.
• Type checking: TypeScript type checking is executed in CI before a production build is accepted.
• Automated tests: unit/integration tests, coverage checks and end-to-end tests run in CI.
• Dependency scanning: the locked dependency set is audited for high-severity vulnerabilities during CI.
• Secret scanning: CI contains a committed-secret detection gate for common high-risk credential and private-key patterns.
• SAST / CodeQL: GitHub CodeQL analyses JavaScript and TypeScript on pushes, pull requests and a scheduled weekly run.
• Production build verification: CI performs a full application build after linting, type checking and tests.
• Deployment verification: a scheduled production smoke suite exercises the live consulting service with Playwright.

We deliberately do not describe a control as mandatory human review unless it is technically enforced or otherwise evidenced for the relevant repository. Where pull requests are used, review may form part of the development process, but it is not presented here as a universally enforced gate.

Preferred reporting method

Email security@theraeburngroup.com. Please include the affected hostname or service, a clear description, steps to reproduce, impact, supporting evidence, and any suggested mitigation. Do not include unnecessary personal data, credentials, secrets, or live customer data.

Scope

This programme covers internet-facing websites, applications, APIs, and services operated by Raeburn Consulting under domains and infrastructure that we control, including consulting.theraeburngroup.com. Third-party services are only in scope where the issue arises from our configuration or integration and testing is permitted by the third party.

Safe harbour

We will not pursue legal action against researchers who act in good faith, stay within this policy, avoid privacy or service impact, make a reasonable effort to minimise harm, and give us a reasonable opportunity to investigate and remediate before public disclosure. This safe harbour does not authorise activity prohibited by law or by third-party systems outside our control.

Acknowledgement and communication

We aim to acknowledge valid security reports within three business days. We will provide updates when practical and may ask for clarification or additional evidence. Remediation time depends on severity, exploitability, affected systems, and any third-party dependencies.

Confidentiality expectations

Please keep vulnerability details confidential until we confirm that remediation is complete or agree a coordinated disclosure date. We will handle reports on a need-to-know basis and will not publish a researcher's identity without permission unless required by law.

Excluded activity

Do not perform denial-of-service or stress testing, destructive testing, social engineering, phishing, physical intrusion, credential stuffing, password spraying, malware deployment, persistence, lateral movement, bulk automated scanning that materially degrades service, or access, alteration, deletion, exfiltration, or retention of data beyond the minimum necessary to demonstrate a vulnerability. Do not test third-party systems without their permission.

Coordinated disclosure

We support coordinated vulnerability disclosure. Please allow us reasonable time to validate and remediate the issue before publication. We will work with you in good faith on an appropriate disclosure timeline and, where requested and appropriate, attribution.

Security Hall of Thanks

We value independent researchers who help improve the security of our services. When a researcher responsibly reports a genuine security issue, follows this policy, and gives permission to be credited, we may recognise their contribution here after remediation and coordinated disclosure are complete.

Recognition is voluntary and does not imply employment, endorsement, certification, a financial reward, or that a report was eligible for a bounty. We will not publish exploit details, affected customer information, or a researcher's identity without permission.

No bug bounty promise

This is a responsible disclosure programme, not a paid bug bounty. We do not promise financial rewards, although we appreciate responsible reports and may recognise helpful contributions at our discretion.

Machine-readable policy

Our security.txt file provides the canonical reporting contact for automated discovery.