Responsible Disclosure Policy
Guidelines for reporting security vulnerabilities to the SiteSecura project.
1. Our Commitment to Web Security
At SiteSecura, security and integrity are foundational to everything we build. We welcome constructive, ethical contributions from independent security researchers, students, and developers who identify potential security issues within our digital assets.
If you believe you have discovered a security vulnerability in our informational web presence (sitesecura.info) or related services, we encourage you to report it to us in accordance with this policy.
2. Research Guidelines & Expectations
To act in good faith and prevent harm to visitors or infrastructure, all research must strictly adhere to the following principles:
Perform testing only to demonstrate proof-of-concept. Avoid actions that could cause denial of service, service disruption, or data alteration.
Do not view, exfiltrate, alter, or destroy data belonging to any third-party user or domain. If sensitive data is inadvertently accessed, halt testing and report immediately.
Provide clear step-by-step reproduction instructions, HTTP request/response transcripts, and proof-of-concept details so our team can verify and remediate promptly.
Allow our engineering team reasonable time (typically 30–60 days) to validate, investigate, and roll out a patch prior to any public disclosure.
3. How to Submit a Security Report
Please submit your findings directly to our configured security intake channel:
Please include a descriptive subject line (e.g. "[Security Report] XSS in sitesecura.info") and attach reproducible proof-of-concept steps.
- Affected URL, component, or parameter
- Clear description of the underlying flaw and potential impact
- Step-by-step reproduction guide or minimal script
- Suggested remediation advice if known
4. Out-of-Scope Research & Exclusions
The following activities and theoretical findings are strictly out of scope:
- Volumetric denial-of-service (DoS/DDoS) attacks against our domains or infrastructure
- Physical security attacks against any facility or personnel
- Social engineering, phishing, or pretexting aimed at team members
- Reports derived solely from automated vulnerability scanners without manual proof-of-concept verification
- Missing rate-limiting on non-sensitive static endpoints
- Disclosure of known public TLS configurations that do not present a demonstrable vulnerability
5. Rewards & Bounty Clarification
SiteSecura does not currently operate a paid bug bounty program or provide monetary compensation for vulnerability reports. Submissions are made on a voluntary basis. We are grateful to ethical researchers who help us maintain a secure environment and offer our sincere acknowledgment for confirmed, actionable disclosures.
6. Safe Harbor Protection
If you conduct security research in compliance with all guidelines outlined in this policy, we consider your activities authorized and will not initiate legal action against you.