Disclosure Policy

How to report

Email security@cybersecurityv.com with a description, the affected address, steps to reproduce and, if you wish, how you would like to be credited. Our security.txt is published at /.well-known/security.txt.

What we ask

Do not access, modify or delete data that is not yours; do not degrade the service; do not use social engineering; stop and report as soon as you can demonstrate the issue. Testing the demo registry records is welcome.

What we promise

Acknowledgement within two business days, a status update at least every ten business days, remediation of confirmed issues within a timeline proportional to severity, and no legal action against good-faith research that follows this policy.

Publication

We publish fixed issues that affected the registry’s integrity, with credit to the reporter if desired. We do not currently operate a paid bounty programme.