Legal
Security disclosure policy
Last updated 12 October 2026.
1.Our approach
We want to hear about security problems so we can fix them. If you believe you have found a vulnerability in Remote Desk, please tell us privately and give us a reasonable chance to fix it before you tell anyone else. For how we protect the service, see security.
2.How to report
Email hello@thehivez.com with the subject line "Security report". Please include what you found and where, the steps to reproduce it, what an attacker could do with it, and any proof of concept, logs or screenshots that help. Tell us how to reach you.
Do not include real customer data in a report. If you came across personal data by accident, tell us what kind and stop there.
We will acknowledge your report, look into it, and keep you informed of what we decide. We will tell you when it is fixed, and we are glad to credit you if you want that.
3.What is in scope
The Remote Desk hosted service and the web, desktop and Android apps that connect to it, and this website. Examples of what we want to know about: ways to sign in without the right credentials or bypass two-factor, to read or change another organisation's data, to enter a private or password-protected room, to escalate a role or permission, to run code in someone else's session, or to reach server-side data you should not be able to reach.
Self-hosted installations are run by the organisations that deploy them. Please report a flaw in the Remote Desk software itself to us, but contact the operator about the way a particular instance is set up.
4.What is out of scope
Do not use these methods: denial-of-service or load testing, social engineering or phishing of our staff or users, physical attacks, spam, or attacks on our providers and other third parties. Do not access, change, delete or copy data that is not yours, or go beyond what is needed to show the issue.
Automated scanning that generates heavy traffic, and findings that only affect old or unsupported browsers, missing best-practice headers with no demonstrated impact, or issues that need a device that is already compromised, are of low value to us.
5.Testing safely
Use only your own accounts, or accounts whose owners have agreed, and your own organisation. Do not test against other customers. Stop and tell us if you gain access to data that is not yours. Do not degrade the service for other people, and keep within the rate limits.
6.Disclosure
Please do not make details public, or share them with others, until we have confirmed a fix is in place or we have agreed a date with you. We will not unreasonably delay a fix, and we will work with you on timing if you want to publish after it.
7.Good-faith safe harbour
If you follow this policy, act in good faith, and avoid harm to people and to the service, we will treat your research as authorised, we will not start legal action against you for it. This does not cover activity that breaks the law in ways that this policy does not allow for, and it does not bind other people or organisations that may be affected.