Back to Home

1. Program Overview

Cryptoffsize's Responsible Disclosure Program encourages security researchers to report vulnerabilities they discover in our Platform. We are committed to working with the security community to verify and address reported vulnerabilities promptly.

1.1 Our Commitment

When you report a vulnerability to us responsibly, we commit to:

• Acknowledge: Respond to your report within 48 hours
• Investigate: Thoroughly investigate the reported vulnerability
• Communicate: Keep you updated on our progress
• Fix: Remediate verified vulnerabilities in a timely manner
• Credit: Publicly acknowledge your contribution (if desired)
• Protect: Not pursue legal action for good-faith research

2. Scope

2.1 In Scope

• Web Application: Cryptoffsize website and web services
• Authentication: Login, registration, password reset flaws
• Authorization: Access control bypass, privilege escalation
• Cryptography: Weak encryption, insecure key storage
• Injection: SQL injection, XSS, command injection, etc.
• CSRF: Cross-Site Request Forgery vulnerabilities
• Session Management: Session hijacking, fixation
• Data Exposure: Sensitive data leaks, information disclosure
• Business Logic: Flaws in application logic
• API Security: API vulnerabilities and abuse

2.2 Out of Scope

• Social Engineering: Phishing, vishing, physical security
• Denial of Service: DoS/DDoS attacks
• Spam: Email spam or other spam activities
• Physical Security: Office access, etc.
• Non-Security Issues: Bugs that don't affect security
• Known Issues: Vulnerabilities we've already disclosed
• Theoretical Vulnerabilities: Without proof of concept
• Third-Party Services: Vulnerabilities in services we don't control
• Best Practice Violations: That don't lead to exploitable vulnerabilities

3. Rules of Engagement

3.1 What You Can Do

✓ Allowed

• Test on Your Own Account: Create an account and test features
• Automated Scanning: Use vulnerability scanners (within limits)
• Proof of Concept: Create PoC to demonstrate vulnerability
• Source Code Review: Review publicly available code
• Public Testing: Test publicly accessible pages and APIs

3.2 What You Cannot Do

✗ Prohibited

• Access Other Users' Data: Do not access, modify, or delete others' data
• Disrupt Service: No DoS, DDoS, or service degradation
• Social Engineering: Do not phish or manipulate users/staff
• Physical Testing: No physical access attempts
• Destructive Testing: No data destruction or corruption
• Unauthorized Access: No accessing systems beyond the vulnerability
• Public Disclosure: Do not publicly disclose before we patch
• Extortion: Do not demand payment or threaten disclosure

4. How to Report

4.1 Reporting Process

1. Contact Us: Report via our support system with "SECURITY VULNERABILITY" in subject
2. Provide Details: Include all relevant information (see below)
3. Wait for Response: We'll acknowledge within 48 hours
4. Collaborate: Work with us to verify and understand the issue
5. Give Us Time: Allow reasonable time for remediation before disclosure

4.2 What to Include

A good vulnerability report should include:

• Vulnerability Type: What kind of vulnerability (SQL injection, XSS, etc.)
• Location: URL, endpoint, or specific page affected
• Impact: What an attacker could do with this vulnerability
• Steps to Reproduce: Detailed steps to replicate the issue
• Proof of Concept: Screenshot, video, or code demonstrating the vulnerability
• Suggested Fix: (Optional) How you would fix it
• Your Contact Info: How we can reach you for follow-up

4.3 Report Template

5. Severity Classification

Severity	Description	Response Time
Critical	Remote code execution, authentication bypass, data breach Impact: Complete system compromise	24 hours
High	SQL injection, XSS (stored), privilege escalation Impact: Significant security breach	7 days
Medium	CSRF, information disclosure, XSS (reflected) Impact: Limited security impact	30 days
Low	Information leakage, best practice violations Impact: Minimal security impact	90 days

6. What to Expect

6.1 Response Timeline

• Initial Response: Within 48 hours of report
• Triage: Initial severity assessment within 5 business days
• Investigation: Thorough review of the reported issue
• Remediation: Fix developed and tested
• Deployment: Patch deployed to production
• Verification: Confirm fix resolves the vulnerability
• Disclosure: Public disclosure (if applicable)

6.2 Communication

We will keep you informed throughout the process:

• Acknowledge receipt of your report
• Provide an initial assessment of severity
• Update you on investigation progress
• Notify you when the issue is fixed
• Coordinate public disclosure timeline

7. Recognition & Rewards

7.1 Hall of Fame

We will publicly acknowledge your contribution (if you wish) including:

• Your name (or handle)
• Link to your website/social media (optional)
• Brief description of the vulnerability (after patch)
• Date reported and date fixed

7.2 Bug Bounty (Coming Soon)

We are developing a bug bounty program that will offer monetary rewards for qualified vulnerability reports:

• Critical: TBD
• High: TBD
• Medium: TBD
• Low: Recognition only

Details will be announced when the program launches.

8. Legal Protection

8.1 Safe Harbor

If you comply with this policy when reporting vulnerabilities:

• We consider your research authorized
• We will not pursue criminal or civil legal action
• We will not report you to law enforcement
• We will not pursue DMCA or CFAA claims against you

8.2 Conditions

This protection applies only if you:

• Follow the rules of engagement outlined in this policy
• Report vulnerabilities responsibly and promptly
• Do not access, modify, or delete other users' data
• Do not disrupt or degrade the service
• Do not publicly disclose before we patch the vulnerability
• Make a good-faith effort to avoid harm

9. Coordinated Disclosure

9.1 Disclosure Timeline

We prefer coordinated disclosure:

1. Report: You report the vulnerability to us privately
2. Fix: We fix the vulnerability
3. Coordinate: We work with you to agree on disclosure timing
4. Disclose: We publicly disclose the fixed vulnerability

9.2 Our Disclosure Policy

• Timing: We aim to fix critical issues within 90 days
• Notification: Notify affected users if necessary
• Credit: Give you credit in our security advisory
• Details: Publish technical details after fix is deployed

9.3 If We Don't Fix It

If we cannot fix a vulnerability within a reasonable timeframe, we will:

• Explain why the fix is delayed
• Discuss workarounds or mitigations
• Agree on a revised timeline
• Support responsible disclosure if warranted

10. Examples of Good Reports

10.1 SQL Injection Example

10.2 XSS Example

11. Questions?

11.1 Contact Us

11.2 Frequently Asked Questions

Q: Can I test on production?

A: Yes, but only create test accounts and do not access others' data or disrupt service.

Q: How long do I need to wait before public disclosure?

A: We prefer 90 days from report date, but we'll coordinate with you.

Q: Can I mention this in my resume/portfolio?

A: Yes, after we've patched and publicly disclosed the vulnerability.

Q: What if I accidentally accessed user data?

A: Inform us immediately, delete any accessed data, and do not proceed further.

Q: Do you accept reports from anonymous researchers?

A: Yes, but we cannot provide recognition or future bounties without contact info.

12. Thank You

Together, we can ensure Cryptoffsize remains secure for all users.

Help us build a more secure platform. Report responsibly.