Responsible Disclosure

1. Our Commitment

ISec Intel is committed to working with security researchers to identify and remediate vulnerabilities. We will act in good faith toward researchers who comply with this policy — no legal action will be taken against researchers who follow these guidelines.

We consider responsible disclosure a form of collaboration. Our team respects the skill and effort required for security research, and we aim to respond quickly and with appreciation for your work.

2. Scope

Asset	In Scope	Notes
isecintel.com	✓ In Scope	Main website and web application
*.isecintel.com	✓ In Scope	All subdomains
API endpoints	✓ In Scope	api.isecintel.com and related APIs
Mobile applications	✓ In Scope	Official ISec Intel apps if published
Third-party services	✗ Out of Scope	Vendors we use but do not control
Social media accounts	✗ Out of Scope	LinkedIn, Twitter, etc.
Client environments	✗ Out of Scope	Never in scope without explicit written auth

3. Vulnerability Classes

In Scope Vulnerabilities

Authentication and authorisation flaws
Remote code execution (RCE)
SQL injection and other injection vulnerabilities
Cross-site scripting (XSS) with demonstrated impact
Sensitive data exposure or information disclosure
Privilege escalation
Server-side request forgery (SSRF)
Business logic vulnerabilities with security impact

Out of Scope

Clickjacking on pages without sensitive actions
Self-XSS without a demonstrated attack path
Missing security headers without demonstrated exploit
Rate limiting on non-authentication endpoints
Denial of service attacks
Social engineering attacks against our staff
Findings from automated scanners without manual validation

4. Rules of Engagement

Do not access, modify, or delete data beyond what is necessary to demonstrate the vulnerability
Do not perform denial of service or resource exhaustion attacks
Do not use automated scanners that generate excessive traffic
Stop testing and report immediately if you encounter personal data, financial data, or credentials belonging to users
Do not share details of the vulnerability publicly until we have confirmed remediation
Provide us a reasonable timeframe (90 days minimum) to remediate before public disclosure

5. How to Report

Send your report to security@isecintel.com. Include:

Description of the vulnerability and its potential impact
Step-by-step reproduction instructions
Screenshots, HTTP requests/responses, or proof-of-concept code
Your name or pseudonym (for credit, if desired)

Encrypt sensitive reports using our PGP key available at isecintel.com/pgp.txt

6. Response Timeline

Acknowledgement: Within 2 business days
Initial assessment: Within 7 business days
Status updates: At least every 14 days during remediation
Remediation: Critical issues targeted within 30 days
Credit: After remediation is confirmed

7. Safe Harbour

ISec Intel will not pursue legal action against researchers who comply with this policy. We consider responsible disclosure research conducted under this policy as authorised activity. If you comply in good faith, we will defend your interests if a third party initiates legal action against you for research covered by this policy.

RESPONSIBLEDISCLOSURE