Vulnerability Disclosure Policy

Cyrenity Cyber takes the security of our systems and our customers seriously. We welcome reports from security researchers and the public, and we are committed to working with you to verify, reproduce, and address legitimate vulnerabilities.

This policy explains what to test, how to report, and what to expect.

Reporting a vulnerability

Email security reports to support@cyrenitycyber.com with:

• A clear description of the issue and its potential impact.
• The affected URL, host, or component.
• Step-by-step instructions to reproduce (proof-of-concept, request/response samples, screenshots, whatever helps us confirm it quickly).
• Any relevant logs, and the date/time of your testing.

If you need to send sensitive details, ask us in your first message and we will arrange a secure channel.

Scope

In scope

• cyrenitycyber.com and its subdomains that we operate.

Out of scope

• Third-party services and infrastructure we do not control (e.g. Microsoft 365, hosting providers, SaaS vendors), even where they appear under our domain.
• Findings that require physical access, social engineering of our staff or customers, or compromise of an account you do not own.

Rules of engagement

• Only test against assets in scope, and only to the extent needed to demonstrate a vulnerability.
• Do not access, modify, or exfiltrate data that is not yours; do not degrade service (no DoS/DDoS, no automated high-volume scanning that affects availability); do not pivot deeper once you have shown impact.
• Stop immediately and report if you encounter customer data, credentials, or personal information. Do not retain copies.
• Give us a reasonable opportunity to remediate before any public disclosure.

Safe harbor

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorized, we will not pursue legal action against you, and we will work with you to understand and resolve the issue quickly. If legal action is initiated by a third party against you for activity conducted in accordance with this policy, we will make this authorization known.

What to expect from us

• Acknowledgement of your report within 3 business days.
• A triage assessment (validity and severity) within 10 business days.
• Progress updates as we remediate, and notification when the issue is resolved.
• Credit for your discovery if you would like it (let us know how to attribute).

We do not currently operate a paid bug-bounty program; this is a coordinated disclosure process.

Preferred language

We accept reports in English.