Which route, account, or provider is affected?
Preparing the governed record.
Bookwiser is loading the requested public or applicant surface without changing its authority state.
Responsible security reportingSecurity and trust
Report a security concern through a path that protects people, evidence, and the investigation.
Bookwiser distinguishes vulnerabilities, suspicious access, privacy exposure, data loss, abuse, and service incidents from ordinary product feedback. A report should identify the affected surface and observable evidence without accessing, changing, downloading, or disclosing more data than necessary.
Begin with the decisions people actually need to make.
These questions connect the public notice to real work, real responsibilities, and a clear next step instead of leaving it as abstract policy language.
What behaviour was observed?
When did it occur?
What minimal evidence supports the report?
Purpose, responsibility, supporting records, and limits stay visible.
The register explains what Bookwiser manages, what requires another person or provider, and which decisions remain outside this process.
Repeatable security weakness
Do not exploit beyond the minimum required to describe the issue.
Unexpected login, session, role, or record access
Use authenticated support when the account remains available.
Information shown to an unintended person or purpose
Avoid copying or redistributing exposed content.
Phishing, impersonation, harmful automation, prohibited use
Preserve message and route evidence without engaging further.
Four stages, with a history that survives the handoff.
This is the expected path through Bookwiser. Actual service, account, provider, privacy, and legal obligations continue to follow the agreements and policies accepted for that relationship.
Protect and report
Stop testing, avoid further access, preserve minimal evidence, and use the security contact route.
Triage the concern
Security classifies impact, affected surface, data, provider, exploitability, and immediate containment needs.
Contain and investigate
Access, provider, deployment, logging, notification, and evidence paths are reviewed by authorized people.
Close and learn
Resolution, communication, residual risk, follow-up controls, and disclosure decisions are retained.
Every promise needs an owner and a way to check it.
These are Bookwiser's public commitments. Signed agreements, qualified professional opinions, and customer-specific deployment reviews add the terms required for each actual relationship.
Good-faith reporting
Reports that follow the published safe-testing boundaries are handled as security work, not general feedback.
Minimal evidence
The reporter should not collect, retain, or disclose unrelated records to prove a concern.
No public disclosure promise
Disclosure timing depends on containment, legal, privacy, provider, customer, and safety obligations.
No bounty promise
The current procedure does not offer or imply a reward program.
Where responsibility remains elsewhere
A public page should never quietly give Bookwiser more authority than the relationship does.
- Destructive testing
- Social engineering
- Data extraction beyond minimum proof
- Guaranteed bounty or disclosure timeline
Choose the route that can keep the right context with the right team.
For your protection, do not send passwords, credentials, tax identifiers, unredacted legal files, private customer records, or complete banking documents through a public contact path.
Public security reportUse contact routing and select Security. Do not include secrets or unrelated personal data.Open security routing Authenticated account incidentUse the support map to preserve the account, organization, route, and session context needed for triage.Open support Review acceptable useSee prohibited access, automation, impersonation, and interference rules.Review acceptable use