CYBER1UP

    Responsible Disclosure Policy

    Last updated: March 1, 2024

    At CYBER1UP, we take security seriously. We value the input of security researchers and the broader community in helping us maintain high security standards. This policy outlines how to report vulnerabilities and what to expect when you do.

    Our Commitment

    We are committed to:

    • Acknowledging receipt of vulnerability reports within 48 hours
    • Providing timely updates on the status of reported vulnerabilities
    • Working collaboratively with researchers to understand and address security issues
    • Giving credit to researchers who help us improve our security (unless you prefer to remain anonymous)
    • Not pursuing legal action against researchers who follow this policy

    Reporting a Vulnerability

    If you believe you've found a security vulnerability in one of our products or services, please send a detailed report to security@cyber1up.com that includes:

    • A description of the vulnerability and its potential impact
    • Steps to reproduce the issue
    • Any proof-of-concept code, if applicable
    • Your name and contact information (if you wish to be credited)

    What We Ask From You

    We request that you:

    • Allow us reasonable time to investigate and address the vulnerability before disclosing it publicly
    • Make a good faith effort to avoid privacy violations, data destruction, and service degradation
    • Only interact with your own accounts or test accounts for security research purposes
    • Not access, modify, or delete data that does not belong to you
    • Not conduct denial of service testing
    • Not use automated tools to find vulnerabilities if they might impact service availability

    Scope

    This policy applies to all products and services developed and maintained by CYBER1UP. It does not apply to:

    • Third-party services or applications that we use but do not develop
    • Open source projects for which we are not the primary maintainer
    • Services hosted by third-party providers

    Our Response Process

    When you submit a vulnerability report, you can expect:

    1. An acknowledgment within 48 hours
    2. An initial assessment of the report within 5 business days
    3. Regular updates on our progress (at least every 7 days)
    4. A notification when the vulnerability has been fixed

    Recognition

    We believe in acknowledging the valuable contributions of security researchers. Unless you prefer to remain anonymous, we're happy to credit you for helping us improve our security.

    Contact Us

    If you have questions about this policy or need to contact us for any security-related issues, please email us at security@cyber1up.com.