Security and disclosure policy

We test other people's systems for a living, so we hold our own to the same standard. If you find a security problem in anything Subcloak runs, please tell us.

How to report

Email hello@subcloak.com with:

• what you found and where,
• steps to reproduce it,
• the impact you think it has, and
• whether and how you'd like to be credited.

Our machine-readable contact details are at /.well-known/security.txt.

In scope

• subcloak.com and its subdomains
• Tools we publish, including Scopegauge
• Client dashboards we host (report the issue without accessing any client data)

What we ask

• Don't access, change or delete data that isn't yours. Stop and report as soon as you see something you shouldn't.
• No denial-of-service, spam, social engineering or physical testing.
• Give us a reasonable time to fix the issue before telling anyone else. We aim for 90 days or less.

What we promise

• We'll acknowledge your report within three business days and keep you updated until it's fixed.
• We won't take legal action against good-faith research that follows this policy.
• We'll credit you publicly if you'd like, once the fix is out.

We don't run a paid bug bounty.

How we disclose issues we find in others' products

When our research turns up a vulnerability in someone else's product, we report it privately through the owner's security contact or disclosure programme first. We don't attach sales pitches to vulnerability reports. We publish details only after a fix is available or after 90 days, whichever comes first, and we request CVE identifiers through the appropriate CNA where one applies.

We never test systems we aren't authorized to test. For client work that means a signed authorization letter; for research it means public information or our own test systems only.