Vulnerability disclosure policy

CISO Talents holds verification evidence, Stealth blocklists and the link between members and their handles, so we take reports seriously. If you have found a vulnerability, email security@cisotalents.com. Our security.txt lists the same contact.

1. In scope

• The website and member app at cisotalents.com.
• Its subdomains that we operate.

We are most interested in issues that would let someone see a profile hidden by Stealth, link a handle to an account, read another member’s messages or evidence, act for an organization they don’t belong to, get around the vendor rules or the directory’s search limits, or take over an account.

2. Out of scope

• Services run by our providers, such as Stripe checkout and Cloudflare. Report those to the provider.
• Denial of service, load testing and high-volume automated scanning.
• Social engineering of members or staff, and physical attacks.
• Reports from automated scanners without a working proof of impact, and missing headers or best practices with no demonstrated risk.
• Spam or rate-limit findings on forms that change nothing, self-XSS, and issues that need a compromised device or an outdated browser.

3. How to test

• Use only accounts you created yourself, and test against them. Never access, change or delete another member’s data.
• If you reach data that isn’t yours, stop, don’t keep a copy, and tell us what you saw.
• Don’t contact members, post in Spaces or send intros as part of a test.
• Don’t scrape the directory. Showing that a limit can be bypassed takes a handful of requests.

4. Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take legal action against you or report you to law enforcement for it, and if someone else does, we will make clear that you acted with our permission. This applies only to our own systems; we can’t authorize testing of our providers’ services.

5. How to report

Email security@cisotalents.com with:

• the URL or feature affected;
• steps to reproduce, with requests and responses;
• what an attacker could do with it;
• how you would like to be credited, if you want to be.

Leave other members’ personal data out of the report. If you need to send something sensitive, say so in your first email and we will arrange a secure channel.

6. What you can expect from us

• We confirm we have your report within 3 working days.
• We send our first assessment within 10 working days and keep you updated until the issue is fixed.
• We ask you to keep the issue private until it is fixed, or for 90 days from your report if that comes first, and we agree a publication date with you.
• We don’t pay bounties at the moment. With your permission, we thank you by name below.

7. Hall of thanks

Nobody is listed yet. Researchers who report a valid issue will be named here with their permission.