logo

Security Policy

Last updated: 13 October 2026

Can Factory is a small team of senior engineers. For over twenty years we have built platforms that have to stay up when everyone arrives at once: blockbuster on-sales, Red Nose Day, Black Friday. Security is part of that job, and we take it personally.

If you have found a security vulnerability in one of our websites, we would like to hear about it. A real person reads every report, and we will work with you to understand and fix it.

Can Factory Limited, Tintagel House, 92 Albert Embankment, London SE1 7TY.

Scope

This policy covers www.canfactory.com and our other websites on canfactory.com that link to it.

If you find a vulnerability in a service we build or run for one of our clients, please report it to that client. If you are not sure who to contact, get in touch with us and we will pass it on.

How to report a vulnerability

Email [email protected] with:

  • a description of the vulnerability and its likely impact;
  • the address (URL) of the page or service affected;
  • the steps needed to reproduce it;
  • how we can contact you.

A clear report with steps to reproduce helps us more than anything else. Please do not include any personal information you may have come across.

What we ask of you

  • Only test against your own data. Do not access, change or delete other people’s information.
  • Do not carry out denial-of-service testing, high-volume automated scanning, social engineering, phishing or physical attacks.
  • Do not use our contact forms to send large numbers of messages.
  • If you come across personal information, stop, and tell us straight away.
  • Give us a reasonable amount of time to fix the issue before telling anyone else about it. We aim to resolve confirmed issues within 90 days, and usually much sooner.

What you can expect from us

  • We will acknowledge your report within five working days.
  • We will keep you informed while we investigate and fix the issue, and tell you when it is done.
  • With your permission, we will thank you by name on this page.
  • We will not take legal action against anyone who reports a vulnerability to us in good faith and in line with this policy.

Rewards

We are a small company and do not run a paid bug bounty programme. We are genuinely grateful for every report made responsibly, and we will happily credit you for your help.

What we do not treat as a vulnerability

  • Reports from automated tools that do not show a real impact.
  • Missing best-practice settings, such as some HTTP headers or email records, where no real impact is shown.
  • Unwanted messages sent through our contact forms.
  • Issues in services run by other companies, such as Google or Cloudflare. Please report these to the company concerned.

Thank you

The people below have helped keep our websites secure by reporting an issue responsibly. No one is listed yet: if yours is the first confirmed report, your name could be the first here.

Machine-readable details

Our contact details for security reports are also published in the standard format at /.well-known/security.txt.

And if you enjoy this kind of work, we are sometimes hiring.