Vulnerability disclosure
How to tell us about a security weakness in this website, what we will do about it, and what we ask of you while you look.
If you think you have found a security weakness in this website, we want to hear about it. This policy says what it covers, how to report a weakness, what happens next and what we ask of you. The same contact details are published for automated tools at /.well-known/security.txt, in the format set out in RFC 9116.
1. What this policy covers
- This website, dacros.com, including its contact form and the remote support download.
- dacros.co.uk, which redirects to this website.
It does not cover anyone else's systems, including the providers named on our sub-processors page. Report a weakness in one of those to that provider: we cannot give permission to test systems that are not ours.
2. How to report a weakness
Email security@dacros.com with "Security report" in the subject. Please tell us:
- the address of the page, or the request, that is affected;
- what you found, and the steps that show it;
- what you think someone could do with it.
If your report would include anything sensitive, such as personal data you came across, leave that part out of your first email and say that you have it. We will agree with you how to send it.
3. What happens next
We acknowledge every report. We then look into what you sent and tell you what we found and what we are doing about it. If you want to publish what you found, please wait until it is fixed, and tell us when you plan to.
4. What we ask of you
- Test only what this policy covers, and only as far as you need to show the weakness.
- Do not view, change, copy or delete data that is not yours. If you reach anyone else's data, stop, do not keep it, and tell us.
- Do not disrupt the website: no denial of service, no load testing, and no automated scanning at a rate that slows it down.
- Send no more through the contact form than you need to show a weakness.
- Do not try social engineering, phishing or anything physical against anyone.
- Give us a fair chance to fix a weakness before you tell anyone else about it.
5. Safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as authorised, we will not take legal action against you for it, and we will not report it to the police. If anyone else takes action against you for research that followed this policy, we will make it known that we authorised it. This applies only to what section 1 covers.
6. Rewards
We do not run a bug bounty, and we do not pay for reports.
7. Who we are
Dacros is a trading name of TicketWave HQ Ltd, registered in England and Wales, company number 17143167, at Ground Floor, Radley House, Richardshaw Road, Leeds, LS28 6LE.
8. Related documents
Privacy notice · Sub-processors · Website terms of use · Every page on this site
9. Changelog
- Version 1.1, 9 November 2026. Reports now go to a dedicated address, security@dacros.com, here and in security.txt.
- Version 1.0, 8 November 2026. First publication, with the security.txt file at /.well-known/security.txt that points to it.