Vulnerability disclosure policy
How to report a vulnerability in ofsec.org and what we commit to for researchers acting in good faith.
If you find a vulnerability in our systems, please report it to us. We take reports seriously and do not pursue researchers acting in good faith who follow the rules below.
Scope
- ofsec.org and its subdomains;
- the forms and email addresses of the domain.
Third-party services we use (for example Cloudflare and Google) are out of scope. Please report vulnerabilities in them directly to the provider concerned.
How to report
Send an email to security@ofsec.org with:
- a description of the vulnerability and the affected address;
- steps to reproduce it;
- the possible impact;
- contact details, if you would like a reply.
The contact address is also published in /.well-known/security.txt. You can also report through the Bulgarian national computer security incident response team (НЕРИКС), which coordinates responsible vulnerability disclosure under Article 19(4) of the Cybersecurity Act.
Our commitments
- We acknowledge receipt of the report within 3 working days.
- We keep you informed of our assessment and of progress on the fix.
- We take no legal action against researchers who act in good faith and follow this policy.
- With your consent, we credit you once the vulnerability has been fixed.
We do not pay monetary rewards.
Rules
- Do not carry out denial-of-service (DoS) attacks or load the systems with automated scanning.
- Do not use social engineering, phishing or physical access.
- Do not access, modify or download more data than needed to demonstrate the vulnerability. Delete any data obtained after reporting.
- Do not disclose the vulnerability publicly before it has been fixed or before 90 days have passed since the report, unless we agree on a different period.