Security Policy
ExploitGrid is committed to maintaining the highest security standards. This policy outlines our approach to security, vulnerability disclosure, and incident response.
Responsible Vulnerability Disclosure
Quick Contact
Security vulnerabilities should be reported to [email protected]
Disclosure Process
1. Initial Report
Send detailed vulnerability information to our security team via encrypted email using our PGP key. Include steps to reproduce, potential impact, and any supporting materials.
2. Acknowledgment
We will acknowledge receipt within 24-48 hours and provide a tracking identifier for your report.
3. Investigation
Our security team will validate and assess the vulnerability. We'll provide regular status updates throughout the investigation process.
4. Resolution
Once verified, we will develop and deploy a fix. Critical vulnerabilities receive priority treatment with expedited patching.
5. Disclosure
After the vulnerability is resolved, we will coordinate public disclosure with you and add your contribution to our security hall of fame.
Response Timeframes
Critical Vulnerabilities
Initial response: 4-8 hours
Fix deployment: 24-72 hours
High Severity
Initial response: 24 hours
Fix deployment: 3-7 days
Medium Severity
Initial response: 48 hours
Fix deployment: 1-2 weeks
Low Severity
Initial response: 72 hours
Fix deployment: 2-4 weeks
Security Measures
Technical Security
- • Encryption: AES-256-CBC with HMAC-SHA256 for all sensitive data
- • Authentication: Multi-factor authentication for all admin accounts
- • Access Control: Role-based permissions with principle of least privilege
- • Network Security: WAF, DDoS protection, and network segmentation
- • Monitoring: 24/7 security monitoring and incident detection
- • Backup: Encrypted, geographically distributed backups
Data Protection
- • All user data encrypted at rest and in transit
- • Regular security audits and penetration testing
- • Secure coding practices and code review requirements
- • Regular dependency updates and vulnerability scanning
- • Employee security training and background checks
Incident Response
Response Procedures
Detection & Analysis
Automated monitoring systems and security team analysis to identify and classify incidents.
Containment & Eradication
Immediate containment to prevent further damage, followed by complete eradication of threats.
Recovery & Communication
System restoration and stakeholder communication with transparent incident reporting.
User Notification
In the event of a security incident affecting user data, we will notify affected users within 72 hours via email and platform notifications. Notifications will include the nature of the incident, steps we're taking to address it, and recommended user actions.
Scope and Guidelines
In Scope
- • ExploitGrid web application (exploitgrid.com)
- • API endpoints and backend services
- • Mobile applications (if applicable)
- • Infrastructure and deployment systems
- • Third-party integrations and dependencies
Out of Scope
- • Social engineering attacks against employees
- • Physical attacks against our facilities
- • DoS/DDoS attacks
- • Spam or social engineering of users
- • Issues in third-party applications or services
Research Guidelines
Please DO:
- • Report vulnerabilities responsibly via our security contact
- • Provide sufficient information to reproduce the issue
- • Allow reasonable time for us to respond and fix issues
- • Use test accounts and avoid accessing other users' data
Please DON'T:
- • Access, modify, or delete other users' data
- • Perform attacks that could harm our services or users
- • Publicly disclose vulnerabilities before they're fixed
- • Violate any laws or regulations
Legal Safe Harbor
Safe Harbor Statement
ExploitGrid will not pursue civil or criminal action against security researchers who conduct vulnerability research in compliance with this Security Policy. We consider good-faith security research conducted in accordance with the guidelines below to be authorized conduct. We will work with you to understand and resolve any issues quickly.
Conditions for Safe Harbor
This safe harbor applies to security researchers who:
- • Act in good faith and follow the research guidelines and scope described in this policy
- • Report vulnerabilities through our designated security contact ([email protected]) before any public disclosure
- • Do not access, modify, or delete other users' data beyond the minimum necessary to demonstrate the vulnerability
- • Do not degrade the availability or performance of ExploitGrid services (including denial-of-service attacks)
- • Allow reasonable time for us to remediate before any public disclosure
- • Comply with all applicable laws and regulations
Legal Protections
For qualifying research conducted under this policy, ExploitGrid:
- • Will not initiate or recommend legal action (civil or criminal) against the researcher
- • Considers such research to be "authorized" under the U.S. Computer Fraud and Abuse Act (CFAA), the UK Computer Misuse Act, and equivalent laws in other jurisdictions
- • Will work to ensure that third parties (such as internet service providers) who become aware of the research understand that it was conducted under this policy
- • Will not file DMCA takedown notices against researchers who circumvent technological measures in the course of good-faith security research
Safe Harbor Limitations
This safe harbor does not apply to activities that: (a) violate the scope or guidelines outlined in this policy; (b) involve accessing other users' personal data or accounts beyond the minimum necessary to demonstrate a vulnerability; (c) cause significant harm to ExploitGrid users or services; (d) involve extortion or threats; or (e) violate applicable law. ExploitGrid reserves the right to determine whether research qualifies for safe harbor protection on a case-by-case basis.
Recognition Program
We believe in recognizing security researchers who help improve our platform. Eligible researchers who follow our responsible disclosure process will be:
- • Added to our Security Hall of Fame (with permission)
- • Credited in our security advisories
- • Considered for security consulting opportunities
- • Provided with ExploitGrid swag and recognition
Recognition Criteria
Recognition is based on the security impact of the finding, the quality of the report, and adherence to our responsible disclosure guidelines. We reserve the right to determine eligibility for recognition on a case-by-case basis.
Security Contact
For security-related inquiries, vulnerability reports, or security research coordination:
This policy was last updated on 9/18/2026