Vulnerability Disclosure Policy

Email team@cyberexchange.ai with the subject line Security. Tell us what you found, where, and enough detail for us to reproduce it — the request or steps, what you expected, and what happened. Include your name or handle if you would like credit.

Please report to us first and give us a reasonable opportunity to fix the problem before disclosing it publicly.

If you make a good-faith effort to follow this policy, we will treat your research as authorised conduct. We will not pursue or support legal action against you for it, and we will not report it to law enforcement. If someone else brings a claim against you for research that followed this policy, tell us and we will make clear that it was authorised.

This protection covers the research; it does not cover anything you do with data you encounter along the way.

Follow all of these. Research that steps outside them is not covered by the safe harbour above.

• Test only against accounts and data you own or have permission to use. Do not access, modify or retain anyone else’s data.
• If you do encounter data belonging to someone else, stop, do not save or share it, and tell us what you saw.
• Do not degrade the Service. No denial-of-service, no load or stress testing, no automated scanning at volume.
• Do not use social engineering, phishing, or physical attempts against us, our staff, or our providers.
• Do not attempt to extract data at scale, and do not use a finding to take data out of the platform.
• Stay inside our own systems. Our providers have their own disclosure programmes; report issues in their platforms to them.
• Do not publish before we have had a reasonable opportunity to fix the issue.

In scope: the CyberExchange web application and the interfaces we publish, at cyberexchange.ai. Out of scope: anything operated by a third party, and findings that depend on an out-of-date browser, on a user being already compromised, or on physical access to a device.

Reports with no demonstrated security impact — missing headers, banner disclosure, results from an automated scanner with nothing behind them — are unlikely to be actioned.

We read every report. We will confirm receipt and tell you what we intend to do about it. We do not run a bug bounty and do not offer payment, and we do not commit to a response or remediation deadline — we would rather say that plainly than publish a target we cannot hold to. We are happy to credit you when a report leads to a fix, if you want that.

The Acceptable Use Policy prohibits probing and testing the Service. This policy is the exception to it: research that follows the rules above is permitted. Research that does not is a breach of that policy and of the Terms.