Security at PCRiskPro
Last updated: 24 August 2026 · PCRiskPro Limited
Every PCRiskPro release is code-signed as PCRiskpro Limited, hashed, uploaded to VirusTotal, and gated by more than 2,900 automated tests and a dependency vulnerability audit before it can be built at all. Scanning happens entirely on your device. The download page shows you how to verify each of those claims yourself — this page is about what happens if someone finds a hole anyway.
Reporting a vulnerability
If you believe you have found a vulnerability in the PCRiskPro application or in pcriskpro.com, email security@pcriskpro.com. Include the product version, the steps to reproduce what you found, and what you believe the impact is. Please do not include anyone’s personal data in a report.
What you can expect from us
We will acknowledge your report within two UK business days and give you an initial assessment within five. We will keep you informed while we investigate and fix, and we will credit you in the release notes if you would like to be named. We do not run a paid bug bounty at this stage — we say that up front rather than leave you guessing.
Scope and safe harbour
In scope: the PCRiskPro application and this website. Out of scope: denial-of-service testing, social engineering, physical attacks, and the third-party services we build on — GitHub, our payment provider and our analytics provider run their own disclosure programmes.
If you research in good faith — you do not destroy data, access other people’s data or disrupt the service, and you give us reasonable time to fix an issue before publishing it — we will not pursue legal action against you for that research. If you are unsure whether something is in scope, ask first and we will tell you.
Response targets for everything else
Security reports jump the queue whatever tier you are on. For ordinary support, our published response targets are: Solo — 48 hours · Professional and Enterprise — 24 hours · Partner — 8 hours, in UK business days. General support: support@pcriskpro.com.