Vulnerability Disclosure Policy

Code and Cypher is dedicated to maintaining the confidentiality, integrity, and availability of its web properties and systems. I value the crucial role the cybersecurity research community plays in identifying security vulnerabilities.

This Vulnerability Disclosure Policy (VDP) outlines the rules of engagement, expectations, and commitments for conducting good-faith security research against Code and Cypher web assets.

Safe Harbor Provision

I consider security research conducted in accordance with this policy to be authorized, constructive, and lawful.

If you make a good-faith effort to comply with this policy during your security research:

• I will not pursue civil or criminal legal action against you.
• I will not initiate complaints with law enforcement regarding accidental or good-faith violations.
• I will work cooperatively with you to understand, validate, and remediate the identified vulnerability.

Scope

In-Scope Systems

The following targets are strictly in scope for security vulnerability testing:

• https://codeandcypher.com/ and all first-party subdomains.
• Publicly deployed static site build artifacts, HTTP edge security headers, and client-side web application logic.
• Associated open-source repositories managed under the SixFiveMil GitHub organization (e.g., SixFiveMil/hugo-devsecops-starter).

Out-of-Scope Activities

The following activities are strictly prohibited and do not qualify for safe harbor:

• Denial of Service (DoS/DDoS) attacks or stress-testing against network infrastructure, edge CDNs, or submission APIs.
• Automated, high-volume spamming or fuzzing of the Contact Form or third-party email routing infrastructure (e.g., Web3Forms).
• Social engineering, phishing, spear-phishing, or physical security attacks against site maintainers.
• Accessing, modifying, exfiltrating, or destroying data that does not belong to you.
• Exploitation of third-party SaaS vendors, CDNs, or DNS providers outside the direct configuration of Code and Cypher.

Guidelines for Responsible Testing

To qualify for safe harbor and public acknowledgment:

1. Report Promptly: Submit your findings as soon as practical following discovery.
2. Minimize Harm: Limit your testing to the minimum necessary actions required to demonstrate a Proof-of-Concept (PoC). Avoid modifying data, downloading sensitive records, or causing service degradation.
3. Coordinated Disclosure: Keep vulnerability details confidential until an agreed-upon remediation period has elapsed and the issue has been patched. Do not disclose findings publicly without prior coordination.
4. No Ransom or Extortion: I do not offer cash bug bounties. Demanding compensation or threatening public disclosure violates good-faith principles.

How to Submit a Vulnerability Report

Please report all suspected security vulnerabilities using the secure contact pathway:

👉 Submit via Contact Form

• Select “Security Vulnerability / Disclosure” in the Inquiry Type dropdown.
• Provide a clear, reproducible Proof-of-Concept (PoC) including steps to reproduce, affected URLs, and potential security impact.
• Include your preferred name, handle, and professional link (e.g., LinkedIn or GitHub) if you wish to be credited.

Response Process & SLAs

I take all verified security reports seriously and adhere to the following response timeline:

Researcher Recognition & Hall of Fame

Researchers who adhere to this policy and responsibly report verified, non-trivial security vulnerabilities will be publicly recognized in the Security Hall of Fame & Acknowledgments.