Vulnerability Disclosure Policy

This policy applies to publicly accessible digital systems and services owned or operated by Wyvern Freight, including:

• Wyvern Freight websites
• customer portals
• shipment tracking services
• vendor onboarding systems
• online forms
• Wyvern-operated APIs
• other internet-facing systems specifically operated by Wyvern Freight

Third-party systems not controlled by Wyvern Freight are outside the scope of this policy, even where they are linked to or integrated with a Wyvern service.

If you are unsure whether a system is in scope, contact us before doing any further testing.

Security research must be conducted in good faith and only to the extent reasonably necessary to identify and demonstrate a potential vulnerability.

Researchers should:

• avoid causing harm or disruption
• keep access to data to a minimum
• stop testing once a vulnerability has been sufficiently demonstrated
• report the issue promptly
• keep vulnerability information confidential while we investigate
• cooperate with reasonable requests for more information

This policy does not authorise any activity that could damage, disrupt or compromise Wyvern Freight systems, operations, customers or data.

You must not:

• perform denial-of-service or resource-exhaustion attacks
• intentionally disrupt production systems
• destroy, alter or delete data
• introduce malware, ransomware or malicious code
• use phishing or social engineering
• attempt physical intrusion into our offices, depots, vehicles or facilities
• compromise employee, customer or vendor accounts
• conduct large-scale brute-force or credential-stuffing attacks
• access more information than is necessary to demonstrate the vulnerability
• download databases or collections of customer information
• modify shipment, customer, vendor or employee records
• establish persistent access
• use a vulnerability for fraud, financial gain or any malicious purpose
• move from one affected system into unrelated systems

Do not copy, download, alter, keep or disclose the information beyond what is strictly necessary to report the vulnerability.

Notify us promptly and explain what information may have been exposed. Delete any copies once your report has been made.

Email

compliance@wyvernfreight.com

Your report should include, where possible:

• the affected website, application, API or URL
• a description of the vulnerability
• clear steps to reproduce it
• the potential impact
• relevant technical evidence
• screenshots where useful
• proof-of-concept information where reasonably necessary
• your preferred contact details

Please do not include unnecessary personal, customer or confidential information.

When we receive a report made in line with this policy, Wyvern Freight will aim to:

• acknowledge receipt within [5] business days
• assess whether the issue is within scope
• investigate the reported vulnerability
• prioritise confirmed issues by severity and risk
• ask for more information where necessary
• take reasonable steps to fix the issue
• keep you informed of progress where appropriate

Wyvern Freight supports good-faith security research conducted in line with this policy.

Where a researcher acts in good faith, stays within the scope of this policy, avoids unnecessary access to information, reports the vulnerability promptly and does not use it for malicious or commercial purposes, Wyvern Freight will treat that research as authorised for the purposes described in this policy.

This protection does not apply to conduct that is malicious, destructive, fraudulent, unlawful or materially outside the boundaries of this policy.

Nothing in this policy can authorise conduct that Wyvern Freight does not have legal authority to permit, including under South Africa's Cybercrimes Act or Zimbabwe's computer-crime laws, and it cannot bind law enforcement or third parties.

Please do not publicly disclose a vulnerability before Wyvern Freight has had a reasonable opportunity to investigate and fix it.

Where public disclosure is appropriate, we ask researchers to agree the timing with us.

The appropriate remediation period may depend on the severity, complexity, operational impact and involvement of third-party systems.

Wyvern Freight relies on third-party hosting, software, payment, communications and logistics technology providers.

A vulnerability affecting a third-party system may fall outside our authority to investigate or fix. Where appropriate, we may refer the report to the relevant provider or ask you to contact that provider directly.

Do not test third-party systems simply because they are linked to a Wyvern Freight service.

Not every security observation is a meaningful vulnerability. Examples that may not ordinarily need action include:

• missing security headers without demonstrated impact
• version information alone
• purely theoretical findings
• self-XSS
• automated scanner output without validation
• clickjacking on pages with no sensitive functionality
• issues that only affect unsupported or outdated browsers or software
• known-vulnerable libraries without evidence of exploitability
• cosmetic or usability defects

If you believe an issue creates a real security risk, you may still report it and explain the impact.

Wyvern Freight does not currently operate a bug bounty programme.

Submitting a report does not create any entitlement to payment, reward, compensation, employment or contractual engagement. Any recognition or reward is at Wyvern Freight's discretion unless agreed in writing.

Information submitted under this policy will be used to investigate, manage and respond to the reported security issue.

Personal information will be handled in line with our Privacy & Data Protection Notice, South Africa's Protection of Personal Information Act (POPIA) and Zimbabwe's Cyber and Data Protection Act.

If a reported vulnerability indicates that personal information may have been compromised, Wyvern Freight will assess the matter under its breach-response and regulatory notification obligations.

Wyvern Freight may update this policy as its systems, security programme and regulatory obligations change. The version published on this website applies to new reports.

Email

compliance@wyvernfreight.com

For shipment, customer-service, vendor or account enquiries, please use the contact details on our Track page or the Get a Quote form instead.

Shipment tracking

tracking@wyvernfreight.com

Customer service

support@wyvernfreight.com

Vendors

vendors@wyvernfreight.com

Accounts

accounts@wyvernfreight.com

• Privacy & Data Protection
• Code of Ethics
• Terms & Conditions
• Integrity Line