Vulnerability Disclosure

How to report

Email contact@cyberintelconsulting.com with "Security" in the subject line. Keep the first message short: what you found, where, and how to reach you. Please don't include sensitive data, credentials, or full exploit details in that first email. We'll reply with a secure way to share the details.

A useful report tells us the affected URL or system, what the issue is and why it matters, and the steps to reproduce it.

What's in scope

You may test the following, following the rules below:

• cyberintelconsulting.com and www.cyberintelconsulting.com, the public marketing website.

Found something on another system we run, such as another subdomain? Report it, but don't test it. Some of our systems hold client information, and we won't authorize testing that could expose it. Tell us what you saw and we'll take it from there.

What's out of scope

• Our clients' systems. We don't own them, and nothing on this page authorizes you to test them. That's true even if you found them through us or they're linked to our work. If you come across an issue that affects one of our clients, tell us. We'll pass it to them and credit you if you'd like.
• Third-party services we use, including Netlify, Formspree, Google Analytics, and Cal.com. Report issues in those directly to the provider.
• Denial-of-service, load testing, or anything that degrades availability.
• Social engineering, phishing, or pretexting our team or our clients, and any physical testing.
• High-volume automated scanning, and spam submissions to our contact form.

Rules for good-faith research

• Stop at the first sign of real data. If you reach information that isn't yours, especially anything about our clients, stop right away and report it. Don't view more than you need to confirm the issue, and don't copy, keep, change, or share any of it.
• Use the least intrusive method that shows the problem. Don't pivot deeper into a system, and don't leave anything installed.
• Keep the details private until we've fixed the issue, or for 90 days after your report, whichever comes first. If we need more time, we'll ask and explain why.
• Don't make demands. Tying disclosure to payment or any other condition puts a report outside this policy.

What you can expect from us

• We'll acknowledge your report within two business days.
• We'll keep you updated as we investigate and fix it, and tell you when it's resolved.
• With your permission, we'll credit you publicly once the fix is in place.
• We don't run a paid bug bounty.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized for the in-scope systems listed above. We won't take legal action against you or report you to law enforcement for it. If a third party takes action against you over research that followed this policy, we'll make it known that your work was authorized.

This authorization covers only systems we own. We can't authorize testing of our clients' systems or third-party services. If you're unsure whether something is covered, ask us first.