---
title: "Vulnerability Disclosure Policy"
date: 2026-09-03
canonical: "https://codeandcypher.com/security/"
description: "Code and Cypher's vulnerability disclosure policy, safe harbor commitment, response SLA, and reporting guidelines."
---

# Vulnerability Disclosure Policy


> Code and Cypher's vulnerability disclosure policy, safe harbor commitment, response SLA, and reporting guidelines.

---



Code and Cypher is dedicated to maintaining the confidentiality, integrity, and availability of its web properties and systems. I value the crucial role the cybersecurity research community plays in identifying security vulnerabilities. 

This **Vulnerability Disclosure Policy (VDP)** outlines the rules of engagement, expectations, and commitments for conducting good-faith security research against Code and Cypher web assets.

---

## Safe Harbor Provision

I consider security research conducted in accordance with this policy to be **authorized, constructive, and lawful**. 

If you make a good-faith effort to comply with this policy during your security research:
- I will **not** pursue civil or criminal legal action against you.
- I will **not** initiate complaints with law enforcement regarding accidental or good-faith violations.
- I will work cooperatively with you to understand, validate, and remediate the identified vulnerability.

---

## Scope

### In-Scope Systems
The following targets are strictly in scope for security vulnerability testing:
- **`https://codeandcypher.com/`** and all first-party subdomains.
- Publicly deployed static site build artifacts, HTTP edge security headers, and client-side web application logic.
- Associated open-source repositories managed under the **`SixFiveMil`** GitHub organization (e.g., [`SixFiveMil/hugo-devsecops-starter`](https://github.com/SixFiveMil/hugo-devsecops-starter)).

### Out-of-Scope Activities
The following activities are strictly prohibited and do **not** qualify for safe harbor:
- **Denial of Service (DoS/DDoS)** attacks or stress-testing against network infrastructure, edge CDNs, or submission APIs.
- Automated, high-volume spamming or fuzzing of the [Contact Form](/contact/) or third-party email routing infrastructure (e.g., Web3Forms).
- Social engineering, phishing, spear-phishing, or physical security attacks against site maintainers.
- Accessing, modifying, exfiltrating, or destroying data that does not belong to you.
- Exploitation of third-party SaaS vendors, CDNs, or DNS providers outside the direct configuration of Code and Cypher.

---

## Guidelines for Responsible Testing

To qualify for safe harbor and public acknowledgment:
1. **Report Promptly**: Submit your findings as soon as practical following discovery.
2. **Minimize Harm**: Limit your testing to the minimum necessary actions required to demonstrate a Proof-of-Concept (PoC). Avoid modifying data, downloading sensitive records, or causing service degradation.
3. **Coordinated Disclosure**: Keep vulnerability details confidential until an agreed-upon remediation period has elapsed and the issue has been patched. Do not disclose findings publicly without prior coordination.
4. **No Ransom or Extortion**: I do not offer cash bug bounties. Demanding compensation or threatening public disclosure violates good-faith principles.

---

## How to Submit a Vulnerability Report

Please report all suspected security vulnerabilities using the secure contact pathway:

👉 **[Submit via Contact Form](/contact/)**
- Select **"Security Vulnerability / Disclosure"** in the *Inquiry Type* dropdown.
- Provide a clear, reproducible Proof-of-Concept (PoC) including steps to reproduce, affected URLs, and potential security impact.
- Include your preferred name, handle, and professional link (e.g., LinkedIn or GitHub) if you wish to be credited.

---

## Response Process & SLAs

I take all verified security reports seriously and adhere to the following response timeline:

| Milestone | Target SLA | Description |
| :--- | :--- | :--- |
| **Initial Acknowledgment** | **48 Hours** | I will confirm receipt of your report and begin initial triage. |
| **Triage & Validation** | **5 Business Days** | I will validate the PoC, assess CVSS severity, and determine remediation scope. |
| **Status Updates** | **Every 7 Days** | I will provide regular progress updates while developing and testing fixes. |
| **Remediation & Closure** | **Variable** | Once deployed, I will notify you to re-test and confirm the resolution. |

---

## Researcher Recognition & Hall of Fame

Researchers who adhere to this policy and responsibly report verified, non-trivial security vulnerabilities will be publicly recognized in the **[Security Hall of Fame & Acknowledgments](/acknowledgments/)**.