NativeCMS Service status

NativeCMS Security Reporting

Version 1.0
Effective 31 July 2026

Report a vulnerability or incident

Email security@nativecms.co.uk. For suspected active compromise, exposed personal data or cross-customer access, use the subject URGENT SECURITY and include:

Do not email passwords, recovery codes, Git credentials, private keys or a copy of another person's data. Ask for a protected transfer route if evidence contains sensitive information.

Safe reporting boundaries

Good-faith reports are welcome. Please stop once you have enough evidence to explain the issue. Do not access, alter, retain or disclose another customer's data; disrupt availability; use social engineering; send malware; perform denial-of-service testing; or use automated scanning that creates significant traffic. Request written authorisation before testing beyond your own account or site.

If you accidentally encounter personal or confidential data, stop, do not copy or share it, and report it immediately.

What to expect

NativeCMS reviews reports during the support coverage published in the Support Policy. This is not a promise of 24-hour staffed support. We will acknowledge a useful report as soon as reasonably practicable, investigate, contain risk, and share status information that does not expose other customers or defensive controls.

Confirmed personal-data incidents are escalated and affected customers or regulators are notified without undue delay where required by law or the Data Processing Addendum. Public service incidents are shown at https://status.nativecms.co.uk.

Coordinated disclosure

Please allow reasonable time for investigation and remediation before public disclosure. NativeCMS will not ask you to conceal an unresolved risk indefinitely. Any acknowledgement or disclosure timing will be agreed case by case and cannot override legal obligations.