Responsible Disclosure

1. Purpose and Philosophy

SiteSecura welcomes responsible, coordinated reports of potential security vulnerabilities affecting our public website, web applications, background scanners, APIs, and cloud infrastructure.

Security researchers, customers, and developers who identify a potential weakness are strongly encouraged to report it privately rather than publicly disclosing technical details before SiteSecura has had a reasonable opportunity to investigate, triage, and remediate the issue.

2. How to Report

Please submit your security findings via email directly to our dedicated security inbox:

Please include "Vulnerability Report - [Brief Summary]" in the subject line to ensure expedited routing to our security engineering team.

3. What to Include in Your Report

To help us understand and reproduce the issue rapidly, please provide as much actionable context as possible:

• A clear, concise summary of the observed vulnerability;
• The specific URL, API endpoint, or component affected;
• Step-by-step reproduction instructions or a minimal, non-destructive proof-of-concept;
• Expected behavior versus actual behavior observed;
• Screenshots, HTTP request/response transcripts, or terminal logs where helpful;
• Your assessment of the potential security impact and severity;
• Relevant timestamps and source IP addresses used during testing; and
• Your contact information for follow-up questions.

Do not include unnecessary personal data or confidential information belonging to third parties.

4. Activities to Strictly Avoid

When conducting security research against SiteSecura, researchers must strictly avoid:

• Accessing, copying, downloading, modifying, or deleting customer or organization data;
• Disrupting service availability or degrading system performance;
• Executing denial-of-service (DoS or DDoS) attacks;
• Sending unsolicited messages, spam, or high-volume automated requests;
• Social engineering or phishing attacks against SiteSecura employees, contractors, or users;
• Physical attacks against our hosting infrastructure or offices;
• Credential attacks, brute-force logins, or credential stuffing against user accounts;
• Executing destructive payloads or state-altering injections;
• Establishing backdoors, persistence, or rootkits on our servers;
• Deploying malware, trojans, ransomware, or malicious executables; and
• Accessing information beyond what is strictly necessary to demonstrate the issue.

5. Safe Testing Boundaries

Security research must be limited exclusively to activities reasonably necessary to demonstrate the reported vulnerability.

If a vulnerability inadvertently discloses access to customer data or internal metadata, you must immediately stop testing, refrain from viewing or downloading additional records, purge any locally saved evidence, and notify SiteSecura immediately in your report.

6. Our Response Process

Upon receiving a vulnerability report, our security team will make reasonable efforts to:

1. Acknowledge receipt of your report in a timely manner;
2. Review and assign the report to a security engineer;
3. Attempt to reproduce and validate the finding;
4. Assess potential technical severity and operational impact;
5. Develop, test, and deploy an appropriate remediation; and
6. Communicate relevant status updates with the reporter where appropriate.

7. Coordinated Public Disclosure

We request that researchers coordinate with us prior to releasing public advisories, blog posts, or technical disclosures. Premature disclosure can expose legitimate users to unnecessary risk before mitigations are fully deployed.

We are committed to resolving verified vulnerabilities collaboratively and will discuss mutually agreeable disclosure timelines depending on the complexity of the remediation.

8. Bug Bounty Policy

SiteSecura does not currently operate a public bug bounty program. Submitting a vulnerability report does not create an entitlement to compensation, consulting engagements, or monetary rewards.

We deeply appreciate the ethical research community for helping safeguard our platform and users in the spirit of defensive cybersecurity collaboration.

9. Security Contacts

For vulnerability reports and security-related communications: