Contact us
Book a demo, ask about prices or get help with your account. We reply within one business day.
Book a demo
Tell us about your school, venue or event and we will tailor the walkthrough for you.
About the company
whoot. is built and run in the United Kingdom by Eager Lobster Ltd, a company registered in England and Wales.
- Company
- Eager Lobster Ltd, trading as whoot.
- Registered in
- England and Wales
- Company number
- 17038042 (Companies House, opens in a new tab)
- VAT number
- GB514409609
- Registered office
- First Floor, 1 Des Roches Square, Witan Way, Witney, OX28 4BE
- Phone
- 020 3856 8700
- hellowhoot.me
Report a security issue
whoot. carries messages people rely on in an emergency, so we would far rather hear about a weakness from you than discover it during an incident. Please report any issue to us privately and give us reasonable time to fix it before you make it public.
- Report to
- securitywhoot.me
- Machine-readable policy
- security.txt
- Response
- We acknowledge reports within two working days
The full disclosure policy
What we commit to
- Acknowledgement within two working days
- Every report is acknowledged by a person, with a reference, within two working days of receipt. Reports arriving out of hours that describe an active exploitation are paged to the on-call engineer immediately.
- Triage within five working days
- We confirm whether we can reproduce the issue, assign a severity, and tell you what we found. Anything that could expose one organisation's data to another, or bypass authentication, is treated as critical regardless of how difficult it looks to exploit.
- Remediation targets by severity
- Critical, immediately and within 24 hours. High, within 7 days. Medium, within 30 days. Low, within 90 days or the next planned release. Where a fix depends on a third party we tell you the mitigation in place and the expected date.
- Credit where you want it
- We are happy to credit reporters by name in the resolution notice, or to keep your report anonymous. We will agree public disclosure timing with you rather than impose it.
In scope
- whoot.me and its subdomains, including the dashboard and the marketing site
- api.whoot.me and the documented public API
- auth.whoot.me
- The whoot. iOS and Android applications
Out of scope
- Denial-of-service, load or volumetric testing of any kind
- Social engineering of whoot. staff, customers or their recipients
- Physical attacks against offices or personnel
- Sending SMS, voice or email to anyone who has not consented to receive it
- Automated scanning that generates alert or message traffic for a customer
- Reports produced solely by a scanner, with no demonstrated impact
Safe harbour
If you act in good faith and within this policy, whoot. will not bring or support legal action against you, will not report you to law enforcement, and will treat your testing as authorised for the purposes of the Computer Misuse Act 1990. If a third party brings action against you for research conducted within this policy, we will make that authorisation clear.
What to include
- The affected URL, endpoint or application screen
- What an attacker could achieve, in one sentence
- The steps to reproduce, including any account you used
- Any proof-of-concept request or payload, as text rather than a video where possible