Production domains
- Hosted application and API endpoints under productivityworkbench.com
- Authorised workbench environments operated by MDTS
Responsible disclosure
Vulnerability Disclosure Policy
MDTS UK Limited welcomes coordinated reports from security researchers who help us protect Productivity Workbench and our customers.
Principles
Our commitment to researchers
We value responsible disclosure and will work with you in good faith.
- Give us reasonable time to investigate and remediate before public disclosure.
- Avoid accessing other customers' data or disrupting service availability.
- Test only against accounts you own or environments we have authorised in writing.
- Provide enough detail for us to reproduce the issue reliably.
Scope
What is in scope
Security concerns we prioritise
- Authentication and session handling
- Authorisation and tenant isolation
- Injection and data-exposure flaws in application code
- Insecure direct object references across workspaces or organisations
Boundaries
Out of scope
Please do not
- Denial-of-service testing without prior written agreement
- Social engineering of MDTS staff or customers
- Physical or third-party infrastructure outside our control
- Unauthorised environments or demonstration modes
Reporting
How to submit a report
Email enterprise@productivityworkbench.com with the information below. We aim to acknowledge every report within two business days and will keep you informed as we investigate.
Include in your report
- Clear description of the vulnerability and its impact
- Steps to reproduce, including URLs or API paths affected
- Proof-of-concept if available (avoid attaching customer data)
- Your contact details if you would like credit or follow-up