Working with researchers
If you have found a security weakness in our systems, we want to hear about it. Researchers who report responsibly make our customers safer, and we treat them accordingly.
This policy explains what we consider in scope, how to report, what you can expect from us, and the conditions under which we will not pursue legal action for good-faith research.
How to report
Email us
Send your report from our contact page with "Security" in the subject line. If you can encrypt it, tell us and we will exchange keys before you send details.
Tell us what you found
Include the affected URL or endpoint, a clear description of the issue, the steps to reproduce it, and your assessment of the impact.
Include evidence, minimally
A short proof of concept, screenshots or a request/response capture helps enormously. Collect only the minimum needed to demonstrate the issue.
Give us time
Allow us a reasonable period to investigate and remediate before disclosing publicly. We will keep you updated on progress.
Never send customer data
If your testing exposes personal data, stop immediately, do not download or retain it, and tell us in your report. Describe what you were able to reach rather than sending us the data itself.
Scope
In scope
- The public website and its supporting endpoints.
- The online and mobile banking platform.
- Public APIs we operate.
- Authentication, session management and authorisation flaws.
- Injection, deserialisation and remote code execution issues.
- Server-side request forgery, insecure direct object references and broken access control.
- Stored or reflected cross-site scripting, and cross-site request forgery on state-changing actions.
- Business logic flaws that permit financial or data impact.
- Exposed secrets, credentials or configuration.
Out of scope
- Denial of service, volumetric or stress testing of any kind.
- Social engineering, phishing or physical attacks against our staff, customers or premises.
- Findings from automated scanners without a demonstrated, exploitable impact.
- Missing security headers, cookie flags or TLS configuration issues with no demonstrated exploit.
- Self-XSS, clickjacking on pages with no sensitive action, and issues requiring an already-compromised device.
- Reports about software versions without a working proof of concept.
- Vulnerabilities in third-party services we do not operate — please report those to the operator.
Rules of engagement
To stay within this policy, you must:
- Only test against accounts you own or have explicit permission to test.
- Never access, modify, delete or exfiltrate data belonging to anyone else.
- Never degrade, disrupt or interrupt our services or our customers' access to them.
- Never use an intermediary, an unpatched third party or a customer device as a route in.
- Stop testing as soon as you have confirmed a vulnerability, and report it.
- Keep the details confidential until we confirm the issue is resolved or we agree a disclosure date.
- Comply with all applicable law.
Extortion is not research
Any attempt to demand payment in exchange for withholding a vulnerability, or any threat to disclose or exploit it, takes the matter outside this policy entirely and will be reported to law enforcement.
Safe harbour
Where you research in good faith and comply with this policy, Prime Wealth Corporation Bank will:
- Not initiate or support legal action against you in respect of that research.
- Treat your activity as authorised for the purposes of relevant computer misuse legislation.
- Work with you if a third party brings action against you for activity conducted within this policy, to confirm that it was authorised.
This protection does not extend to activity that breaches the rules of engagement above, and it cannot bind third parties whose systems you may have touched.
If in doubt, ask first
If you are unsure whether a specific test is permitted, email us and ask before you run it. We would much rather answer a question than receive an apology.
What you can expect from us
| Stage | Our commitment |
|---|---|
| Acknowledgement | We confirm receipt of your report, normally within two working days. |
| Triage | We validate and assess severity, and tell you our assessment. |
| Updates | We keep you informed of progress at reasonable intervals until the issue is closed. |
| Resolution | We tell you when a fix is deployed and, where appropriate, invite you to verify it. |
| Credit | With your consent, we are happy to acknowledge your contribution publicly once the issue is resolved. |
Prime Wealth Corporation Bank does not currently operate a paid bug bounty. We are grateful for reports regardless, and we say so properly.
This is not the channel for
Documents you may also need
Security Centre
How Prime Wealth Corporation Bank protects your money and your data, what we will never ask you for, and the handful of habits that stop almost every attack.
GovernanceReport Misconduct
A confidential channel for reporting suspected wrongdoing at Prime Wealth Corporation Bank — open to staff, customers, suppliers and anyone else, with protection against retaliation.
Legal & RegulatoryPrivacy Statement
What personal data Prime Wealth Corporation Bank collects, why we need it, who we share it with, how long we keep it, and the rights you have over it.
This document was last updated on 1 August 2026. We publish the current version here at all times; superseded versions are available on request.
If anything on this page is unclear, write to us and we will explain it.