Responsible disclosure
Found a vulnerability on securitynews.ms? How to report it safely, what is in scope and what you can expect in return.
A website about security should practise what it preaches. Still, no system is perfect. If you find a vulnerability, we’d like to hear about it so we can fix it before anyone misuses it. This policy follows the Dutch practice of Coordinated Vulnerability Disclosure (CVD).
How to report
Send your report to the address on our contact page. A good report contains:
- What: the type of vulnerability and the affected address (URL).
- How: the steps to reproduce it, ideally with a proof of concept or screenshots.
- Impact: what an attacker could do with it.
- You: how we can reach you, and whether you’d like to be credited.
Please keep the report confidential until the issue is fixed.
Scope
In scope: securitynews.ms and www.securitynews.ms.
Out of scope: issues in third-party services, such as Cloudflare, GitHub or Microsoft; please report those to the vendor directly. Also out of scope are findings without a realistic security impact, for example:
- missing security headers or settings without demonstrable risk;
- version disclosure or descriptive error messages on their own;
- reports from automated scanners without a verified, working example;
- SPF, DKIM or DMARC configuration advice;
- clickjacking on pages without sensitive actions.
Vulnerabilities in Microsoft products belong with the Microsoft Security Response Center, not with us.
Rules of engagement
- Do no harm: no denial-of-service, no brute-forcing and no tests that make the website slower or unavailable.
- Stay minimal: only do what is needed to show the vulnerability. Don’t change or delete data.
- Respect privacy: don’t access, copy or keep personal data of others. If you come across it by accident, stop, delete it and mention it in your report.
- No social engineering: no phishing, no physical access attempts and no pressure on people or suppliers.
- Keep it confidential until the issue is fixed.
What you can expect
If you follow this policy:
- A quick reply: a response within 5 working days, with our first assessment.
- Updates: we keep you informed and aim to fix confirmed issues as quickly as possible, normally within 60 days.
- No legal action: we will not take legal action against you for your report, and we will not pass your details to third parties without your permission, unless the law requires it.
- Credit: with your permission, your name or alias is listed below.
This is not a bug bounty: there are no cash rewards.
Hall of fame
No reports yet.