LEGAL

Responsible Disclosure

Last updated 6 September 2026

Responsible Disclosure and CMS Legal Notices Pack

Effective date: 5 September 2026

1. Introduction

LMTS QA Consulting takes the security of its website, applications, systems and information seriously.

We appreciate responsible reports from security researchers, customers, technology professionals and members of the public who identify potential security vulnerabilities.

This policy explains how suspected vulnerabilities relating to LMTS-controlled public systems should be reported.

2. Scope

Unless LMTS expressly states otherwise, this policy applies to:

  • www.lmtsqa.co.za;

  • the LMTS public web application hosted on LMTS-controlled infrastructure;

  • LMTS-controlled subdomains expressly associated with the public website or web application; and

  • public internet-facing functionality operated by LMTS.

Third-party services not controlled by LMTS are excluded from scope.

Where there is uncertainty about whether a system is operated by LMTS, contact us before performing security testing.

3. Important Authorisation Boundary

This policy encourages responsible disclosure but does not provide unlimited authorisation to test LMTS systems.

You must not:

  • gain access to another person's account;

  • access information that does not belong to you;

  • bypass authentication to obtain confidential information;

  • download or exfiltrate personal information;

  • modify or delete information;

  • interfere with production systems;

  • introduce malware;

  • conduct denial-of-service testing;

  • perform load or stress testing;

  • conduct social engineering;

  • conduct phishing;

  • test employees' physical security;

  • attempt password spraying or credential stuffing;

  • use stolen or leaked credentials;

  • intentionally maintain persistent access;

  • alter application data belonging to another person;

  • interfere with recruitment applications;

  • spam website forms;

  • disrupt website availability; or

  • conduct destructive testing.

More intrusive penetration testing requires prior written authorisation from LMTS.

4. Permitted Good-Faith Research

Where testing is undertaken, researchers should:

  • use accounts and information they own or are expressly authorised to use;

  • make the minimum requests reasonably necessary to confirm the issue;

  • avoid viewing personal or confidential information;

  • stop testing immediately if sensitive information becomes accessible;

  • avoid degradation of service;

  • avoid automated activity that generates unreasonable traffic;

  • protect any information inadvertently encountered; and

  • report the vulnerability promptly.

A vulnerability should be demonstrated using the least invasive method reasonably possible.

5. Sensitive Data

If you inadvertently encounter:

  • passwords;

  • API keys;

  • authentication tokens;

  • personal information;

  • job applications;

  • CVs;

  • client information;

  • financial information;

  • confidential documents; or

  • other sensitive information,

you must stop accessing the information and notify LMTS.

Do not copy, retain, distribute or publicly disclose such information beyond what is strictly necessary to report the issue.

6. How to Report a Vulnerability

Security vulnerabilities should be reported to:

Security Email:
[INSERT security@lmtsqa.co.za OR APPROPRIATE ADDRESS]

The report should preferably include:

  • vulnerability type;

  • affected URL or component;

  • date and time identified;

  • clear reproduction steps;

  • proof of concept where safe;

  • screenshots where useful;

  • potential impact;

  • whether any information was accessed;

  • your contact details; and

  • suggested remediation, if available.

Do not include unnecessary personal information or confidential third-party data in the report.

7. What You Can Expect From LMTS

Where a report appears credible, LMTS will seek to:

  • acknowledge the report;

  • investigate the issue;

  • reproduce and assess the vulnerability;

  • prioritise remediation based on risk;

  • communicate where further information is needed; and

  • notify the reporter when appropriate.

Complex vulnerabilities may require coordination with hosting, software or other technology providers.

8. No Bug Bounty Promise

This Responsible Disclosure Policy is not a bug bounty programme.

LMTS does not promise payment, rewards, gifts or compensation for vulnerability reports unless a specific reward programme is separately announced in writing.

9. Public Disclosure

Researchers should allow LMTS a reasonable opportunity to investigate and remediate a reported vulnerability before making information public.

Details should not be published where disclosure would:

  • expose personal information;

  • materially increase security risk;

  • reveal credentials;

  • facilitate attacks; or

  • breach applicable law.

Any coordinated public disclosure should preferably be agreed with LMTS in advance.

10. Privacy

Contact information supplied by a security researcher will be used to:

  • investigate the vulnerability;

  • communicate regarding the report;

  • maintain security records; and

  • comply with applicable legal obligations.

Information will be handled in accordance with the LMTS Privacy Policy.

11. Applicable Law

Security research must comply with applicable South African law.

Nothing in this policy authorises conduct that is unlawful or exceeds the boundaries expressly described above.

Back to home
ESC