Security policy

1. Reporting a Vulnerability

We take the security of the BeGOOD Solutions website and the people who contact us seriously. Please do not report security problems publicly.

Email us with the subject line [SECURITY]. Include the affected URL, steps to reproduce, the impact you observed, and any proof of concept. Write to: security@begood.solutions

2. What Happens Next

These are the targets we aim for, not guaranteed deadlines. They may change, for example with the severity or complexity of a report:

• Acknowledgement of your report: usually within 3 business days
• Initial assessment and severity: usually within 7 business days
• Fix for critical issues: we aim for 72 hours after confirmation
• Fix for high-severity issues: we aim for 7 days after confirmation
• Public credit, if you want it: after the fix ships

3. Supported Versions

Only the current production site (https://www.begood.solutions) receives security fixes. Staging and preview deployments are access-protected and out of scope for public testing.

4. Scope

In scope:

• The production website and its contact form
• The metadata and AI-agent files: /robots.txt, /sitemap.xml, /llms.txt, /llms-full.txt, and /.well-known/security.txt

5. Out of Scope

• Vulnerabilities in third-party services and platforms we use: please report these to the vendor
• Volumetric denial-of-service attacks
• Social engineering
• Findings that require a compromised device

6. Rules of Engagement

Do not access, change, or delete other people's data, and do not run automated scans that degrade the site for others. We will not pursue action against good-faith research that follows this policy.