Responsible
Disclosure Policy

Scope

This policy applies to vulnerabilities discovered in CyberMapSec-owned systems, including:

• cybermapsec.com and all subdomains
• Any CyberMapSec web applications or portals
• CyberMapSec API endpoints
• CyberMapSec email infrastructure

This policy does not extend to client systems we have assessed. Client vulnerabilities are reported directly and exclusively to the client under separate engagement agreements.

What We Ask of Researchers

When investigating potential vulnerabilities, please:

• Avoid accessing, modifying, or deleting data that does not belong to you
• Do not conduct DoS or DDoS attacks against our systems
• Do not engage in social engineering against our staff or clients
• Do not use vulnerabilities to access client data or internal systems
• Report findings promptly — do not publicly disclose before we've had time to remediate
• Provide sufficient technical detail for us to reproduce and validate the issue

What You Can Expect From Us

In return, we commit to:

• Acknowledging your report within 3 business days
• Providing an initial assessment within 10 business days
• Keeping you informed of remediation progress
• Not pursuing legal action against researchers who act in good faith under this policy
• Crediting you in our disclosure (if you wish) once the issue is resolved
• Working toward remediation within a timeframe appropriate to the severity

Out of Scope

The following are generally out of scope and should not be tested:

• Third-party services and infrastructure we use (report these to the vendor directly)
• Denial of service attacks
• Spam or social engineering
• Physical attacks against our premises or personnel
• Automated scanning without prior coordination
• Vulnerabilities requiring physical access to a user's device

Safe Harbor

CyberMapSec considers security research conducted under this policy to be authorized activity. We will not initiate legal action, work with law enforcement to investigate, or pursue claims against researchers who:

• Act in good faith and comply with this policy
• Avoid privacy violations, data destruction, or interruption of services
• Do not exploit vulnerabilities beyond what is necessary to demonstrate the issue
• Report findings to us before public disclosure

If a third party initiates legal action against you while you are following this policy, we will take steps to make known that your actions were conducted in compliance with this disclosure policy.

Disclosure Timeline

We follow coordinated vulnerability disclosure. Our target remediation timelines by severity:

We request that researchers allow us the full remediation period before any public disclosure. If you feel remediation is being unreasonably delayed, please contact us to discuss.

How to Report

Send your report to:

Your report should include:

• A description of the vulnerability type
• The affected URL, parameter, or component
• Step-by-step reproduction instructions
• Screenshots or video demonstrating the issue
• Your assessment of the potential impact
• Your contact information (for follow-up)

For sensitive reports, you may request our PGP public key for encrypted communication.

Recognition

We do not currently offer a monetary bug bounty program. However, we genuinely appreciate responsible disclosure and will acknowledge researchers publicly (with permission) on our security acknowledgements page, and provide a letter of appreciation for professional portfolios.

Questions

If you have questions about this policy or are unsure whether a particular security research activity is within scope, contact us at security@cybermapsec.com before beginning your research.