Legal
Vulnerability Disclosure Policy
Last updated: 7 September 2026
1. Purpose
CyfroSec values good-faith security research. This policy describes how to report a suspected vulnerability in a CyfroSec-controlled system and the conditions under which CyfroSec will treat testing as authorised.
This policy does not create a bug-bounty programme or a right to payment.
2. In-scope systems
Unless CyfroSec states otherwise, this policy applies to:
- the public cyfrosec.com website;
- the CyfroSec-hosted web application and APIs; and
- other internet-accessible systems expressly identified by CyfroSec as in scope.
Customer-controlled systems, repositories, endpoints, networks, on-premises deployments and third-party services are not in scope unless their owner separately authorises testing.
3. Rules for authorised research
To remain within this policy, you must:
- act in good faith and only to identify and report a security vulnerability;
- avoid accessing, copying, changing or deleting data beyond what is minimally necessary to demonstrate the issue;
- stop testing and report immediately if you encounter personal data, customer data, credentials or confidential information;
- avoid disruption, degradation or unreasonable load;
- not conduct denial-of-service, stress testing, social engineering, phishing, physical intrusion or malware deployment;
- not test customer environments or third-party systems without their express authorisation;
- not use a vulnerability to obtain money, demand payment or threaten disclosure;
- keep the issue confidential until CyfroSec has had a reasonable opportunity to investigate and remediate it; and
- comply with applicable law.
Automated scanning must be rate-limited and must not interfere with availability or generate excessive traffic.
4. How to report
Send reports to safety@cyfrosec.com with the subject line “Security Vulnerability Report”. Include, where available:
- the affected URL, endpoint, service or version;
- a clear description of the issue and potential impact;
- reproducible steps or a minimal proof of concept;
- relevant timestamps, request identifiers, screenshots or logs;
- whether any data was accessed and what type;
- suggested remediation, if known; and
- a secure way to contact you.
Do not send live credentials, private keys, unnecessary personal data, destructive code or complete customer datasets. Ask for a secure transfer method if sensitive evidence is required.
5. What you can expect
CyfroSec will use reasonable efforts to acknowledge a complete report, assess its severity, keep the reporter informed where appropriate and remediate validated issues according to risk and available information. Complex issues, third-party dependencies and coordinated releases may require additional time.
CyfroSec does not guarantee a specific response or remediation time under this public policy. Contractual incident and support targets, where any, are governed by the applicable customer agreement.
6. Safe-harbour position
Where you comply with this policy and applicable law, CyfroSec will treat your research as authorised for the limited purpose of identifying and reporting the vulnerability and will not initiate legal action solely because of that compliant research. This statement does not authorise conduct against third parties, excuse unlawful activity, bind law-enforcement authorities or waive rights arising from conduct outside this policy.
If you are unsure whether proposed testing is permitted, contact safety@cyfrosec.com before proceeding.
7. Disclosure
Do not publicly disclose a suspected vulnerability before CyfroSec confirms that remediation has been completed or agrees to a coordinated disclosure date. CyfroSec may credit a reporter with permission, but cannot promise public recognition or payment.