CyberGrid welcomes reports of security vulnerabilities that may affect our systems, applications, services, or infrastructure.
If you believe you have identified a security issue, please report it responsibly to:
Responsible disclosure
If you act in good faith and follow this policy:
- We consider your research authorized.
- We will not pursue legal action against you.
- We will work with you to validate and remediate the issue.
- We ask that you keep vulnerabilities confidential until remediation has been completed or disclosure has been coordinated.
What we ask from researchers
- Avoid disrupting services.
- Avoid accessing or modifying data.
- Use only the minimum testing necessary to verify a vulnerability.
- Report vulnerabilities promptly.
- Stop testing immediately if you encounter personal, confidential, or customer information.
In scope
This policy applies to CyberGrid-owned and CyberGrid-operated products, services and publicly accessible systems.
Out of scope
The following activities are not authorized:
- Denial of Service (DoS/DDoS) testing
- Social engineering
- Phishing attacks
- Physical security testing
- Brute-force attacks
- Credential stuffing
- Data exfiltration
- Malware deployment
- Testing of customer-owned systems
- Testing of third-party systems not operated by CyberGrid
Reporting guidelines
To help us investigate your report, please provide:
- A description of the vulnerability
- Affected system or URL
- Reproduction steps
- Potential impact
- Screenshots or supporting evidence where available
Reports may be submitted anonymously.
Response commitments
CyberGrid aims to:
- Review and validate findings as quickly as reasonably practicable.
- Maintain communication where contact information is provided and further information is required.
- Coordinate disclosure with researchers when appropriate.
- Handle reported vulnerabilities in accordance with CyberGrid's internal vulnerability management process.
Contact: security@cyber-grid.com