HRHK Solutions, LLC | Last Updated: January 1, 2026
Security Research Welcome
HRHK encourages responsible security research. If you believe you have found a security vulnerability in our systems, please report it to us following this policy.
HRHK Solutions takes the security of our website, services, and client systems seriously. We encourage security researchers and members of the public to responsibly report security vulnerabilities they discover in our website or services. We are committed to working with the security research community to investigate and resolve reported vulnerabilities.
This policy covers security vulnerabilities discovered in:
Important
This policy applies only to HRHK Solutions' own website and services. It does not authorize testing of any third-party systems, client systems, or any infrastructure you do not own or have explicit written authorization to assess.
If you discover a security vulnerability, we ask that you:
Report it privately
Send your findings to info@hrhk.net with "Security Disclosure" in the subject line. Do not disclose the vulnerability publicly until we have had a reasonable opportunity to investigate and address it.
Provide sufficient detail
Include a description of the vulnerability, steps to reproduce, affected URLs or components, and any relevant technical details that will help us understand and validate the issue.
Avoid destructive testing
Do not exploit the vulnerability beyond what is necessary to demonstrate its existence. Do not access, modify, or delete data that does not belong to you. Do not disrupt services or degrade performance.
Respect privacy
Do not access, store, or share personal data belonging to HRHK, our clients, or our users. If you inadvertently encounter such data, do not copy it and report the encounter to us.
When you report a vulnerability in accordance with this policy, we commit to:
While investigating vulnerabilities, please avoid:
To report a security vulnerability:
Email info@hrhk.net
Include "Security Disclosure" in the subject line
Provide a clear description of the vulnerability
Include steps to reproduce the issue
Specify affected URLs, endpoints, or components
Include any relevant technical details or proof-of-concept (non-destructive)
Indicate whether you wish to be publicly acknowledged or remain anonymous
Our general timeline for handling responsible disclosures:
Acknowledgment
Within 5 business days of receipt
Initial Assessment
Within 10 business days of acknowledgment
Remediation
Timeframe depends on severity and complexity; we will communicate our estimated timeline
Public Disclosure
Coordinated with the reporter after remediation, respecting any agreed-upon timeline
HRHK Solutions will not initiate legal action against security researchers who comply with this policy. We consider good-faith security research that follows these guidelines to be valuable contributions to our security posture.
For security-related inquiries or to report a vulnerability:
Publication Readiness
Professional mechanism for reporting security vulnerabilities affecting HRHK-controlled systems, including safe harbor provisions.
Decision Table
| Signal | Implementation Evidence | Visitor Value |
|---|---|---|
| Policy scope | Who and what the policy covers | Improves clarity before publication |
| Control statement | Responsibilities, limitations, and contact route | Reduces ambiguity |
| Enterprise confidence | Privacy, security, accessibility, and disclosure posture | Supports vendor review |