We take security seriously. If you discover a vulnerability in our platform, we encourage you to report it responsibly. We commit to working with you to understand and address the issue quickly.
Email support@cyberguardian.bg with a clear description of the vulnerability, steps to reproduce.
We will acknowledge receipt of your report within 48 business hours and provide an initial assessment of the severity and scope.
We investigate the report and work on a fix. We will keep you updated on progress and expected resolution timeline.
Once the fix is deployed, we coordinate public disclosure with you. Researchers who follow this policy will receive credit in our security advisories.
Severity is set with CVSS v3.1. If a fix needs longer, we tell you why and agree a new date with you.
If you act in good faith and follow this policy, we will not take legal action against you and will not ask any authority to do so.
Good faith means: you test only your own accounts or installations, you do not access, change or delete other people's data beyond what is needed to show the issue, you do not disrupt our service, and you give us reasonable time to fix the issue before you disclose it.
If a third party takes action against you for research done under this policy, we will make it known that your work was authorised.
Please do not disclose a vulnerability publicly before it is fixed. We publish fixed issues in our release notes and, with your permission, credit you by name. We do not run a paid bug bounty at this time.
This policy is also referenced from /.well-known/security.txt
Send your vulnerability report directly to us. We respond to all valid reports within 48 business hours.
support@cyberguardian.bg