Security & Responsible Disclosure Policy

Security is our product, so we welcome reports from researchers who find a weakness in HackGrade. This page explains how to report it and what we promise in return.

1. How to report

Email [SECURITY/PRIVACY EMAIL] with a description of the issue, the steps to reproduce it, the affected URL and the impact you think it has. Please do not include other people's personal data. Our contact details are also published in machine-readable form at /.well-known/security.txt.

2. In scope

• This website and its API: hackgrade.com (incl. www.hackgrade.com), hackgrade.185-202-223-42.sslip.io and any domain we publish as ours.
• Our scanner's behavior, for example a scan that goes outside the verified domain or exceeds the published limits.

3. Out of scope

• Websites of our customers. Report those to the site owner, not to us.
• Third-party services we use (hosting, payments, email). Report to them directly.
• Denial-of-service, load testing, spam, social engineering of staff or users, and physical attacks.
• Reports from automated tools without a demonstrated impact, missing best-practice headers without a real risk, and self-XSS.

4. Rules for testing

• Use only accounts you created yourself, and do not access, change or delete other users' data. If you reach someone else's data by accident, stop, do not keep it, and tell us.
• Do not run deep scans of sites you do not own through our Service in order to test it.
• Keep your test volume low and stop if you notice degradation.
• Give us reasonable time to fix the issue (we aim for 90 days, sooner for serious issues) before you publish anything, and coordinate the publication with us.

5. Our promise (safe harbor)

If you act in good faith and follow this policy, we consider your research authorized, we will not take legal action against you or report you to the authorities for it, and if a third party takes action against you over it, we will make it known that your research was authorized. We will confirm receipt within 3 business days, keep you updated, and credit you publicly if you wish. We do not currently pay bug bounties.

This safe harbor covers only HackGrade's own systems. It cannot authorize testing of anyone else's systems.