Vulnerability Disclosure Policy
We value the work of security researchers in helping us keep our systems secure. This policy outlines how to responsibly report vulnerabilities in RawSecLabs systems and services.
The security of our systems and user data is RawSecLabs' top priority. We appreciate the work of security researchers acting in good faith to identify and report potential vulnerabilities in our systems.
This Responsible Disclosure Policy ("Policy") provides guidelines for security researchers to report vulnerabilities to us in a coordinated and responsible manner. By following this policy, researchers help us protect our users and maintain the security of our services.
What This Policy Covers
This policy covers all internet-facing information systems, applications, or websites owned, operated, or controlled by RawSecLabs, including:
- rawseclabs.com and all subdomains
- Web applications and APIs hosted on our domains
- Client portals and assessment delivery platforms
- Mobile applications published by RawSecLabs
This policy does not cover third-party services, systems not owned by RawSecLabs, or vulnerabilities in client systems we assess as part of our services.
Vulnerability Types We're Interested In
We are interested in technical vulnerabilities that could impact the security or privacy of our users, including but not limited to:
Injection Attacks
SQL injection, command injection, LDAP injection
Cross-Site Scripting (XSS)
Reflected, stored, and DOM-based XSS
Authentication Issues
Weak authentication, session management flaws
Authorization Bypass
Privilege escalation, access control bypass
Sensitive Data Exposure
Data leakage, insecure data storage
Configuration Issues
Security misconfigurations, exposed services
Safe Harbor
If you follow this policy in good faith, RawSecLabs commits to:
- Not pursue legal action against you for security research conducted in accordance with this policy
- Work with you to understand and resolve the issue
- Recognise your contribution if you request public acknowledgement
How to Submit a Report
To submit a vulnerability report, please email us at:
contact@rawseclabs.com
For encrypted communication, you can use our PGP key:
Report Requirements
To help us investigate and resolve issues quickly, please include the following information in your report:
- Description: A clear description of the vulnerability
- Steps to Reproduce: Detailed steps to reproduce the issue
- Impact: Assessment of the potential impact
- Evidence: Screenshots, logs, or proof-of-concept code (if safe)
- Contact Info: How we can reach you for follow-up
Guidelines for Researchers
Do:
- Report vulnerabilities through the designated channel
- Provide sufficient information for us to reproduce the issue
- Allow us reasonable time to investigate and respond
- Test only on systems covered by this policy
- Use non-destructive testing methods
Don't:
- Access, modify, or delete data that is not your own
- Use denial of service attacks or cause service disruption
- Access user accounts or data without authorisation
- Disclose vulnerabilities publicly before we address them
- Use social engineering or physical security testing
What to Expect From Us
Initial response acknowledging receipt
Detailed assessment and next steps
Remediation timeline based on severity
We will keep you informed of our progress and notify you when the issue has been resolved. For high-severity issues, we will work on an accelerated timeline.
Recognition
We value the security research community and want to recognise valid contributions. If you discover a qualifying vulnerability and follow this policy, we offer:
- Public acknowledgement in our security advisories (with your permission)
- Credit in security advisories and release notes
- RawSecLabs swag for significant contributions
We do not currently offer monetary bug bounties, but we recognise valuable contributions through acknowledgement and credit.
Important Legal Notice
This policy is not a guarantee that we will not take legal action if you violate the law or our terms of service. Research must be conducted in good faith and within the bounds of this policy to qualify for safe harbor protection.
If you are unsure whether your testing activity is permitted, please contact us first at contact@rawseclabs.com before proceeding.
Ready to Report a Vulnerability?
Send your report to our security team. We appreciate your help in keeping our systems secure.