Security disclosure

This page describes how to report security vulnerabilities affecting THREATBYTES™ websites, APIs, authentication, or infrastructure. We support coordinated disclosure so issues can be fixed before public details are shared.

Reports we want to receive include, for example:

- Authentication, session, or authorisation flaws in the web platform. - Cross-site scripting, injection, or CSRF in site-owned pages and API routes. - Insecure direct object access to research or specimen data. - Misconfiguration exposing secrets, database backups, or internal admin interfaces. - Denial-of-service issues with clear impact on availability (report without sustained live attack traffic).

The following are generally out of scope unless they demonstrate clear impact on THREATBYTES™ infrastructure:

- Social engineering or phishing against individuals. - Physical security of unrelated facilities. - Vulnerabilities in third-party services unless they clearly compromise our deployment. - Findings in sandboxed malware behaviour itself (expected) without a platform escape. - Scanner output without proof of exploitability.

Do not test against production user data you do not own. Use demonstration accounts where provided.

Do not email live malware binaries to the security contact. Use governed specimen submission workflows documented under research ethics and data pages. Security reports should describe platform vulnerabilities, not ship malicious payloads.

Send a detailed report to the security email address on this page (see Contact panel). Encrypt sensitive reports with PGP if we publish a key; otherwise request a secure channel in your initial message.

Include: description, impact, steps to reproduce, affected URLs or endpoints, proof-of-concept if available, and your preferred contact for follow-up.

If you act in good faith - avoid privacy violations, data destruction, service disruption beyond minimal proof, and access to data that is not yours - we will not pursue legal action for authorised research-style testing that complies with this policy. We cannot bind third parties or guarantee outcomes in all jurisdictions.

We aim to:

- Acknowledge receipt within five working days. - Provide an initial assessment within fifteen working days where complexity allows. - Keep you informed of remediation progress for valid issues. - Coordinate public disclosure timing with you; we prefer fixes deployed before detailed advisories.

Critical issues may be mitigated urgently with shorter communication cycles.

With your permission, we may acknowledge researchers in release notes or a security hall of fame once issues are resolved. We do not operate a paid bug bounty unless separately announced.

Use the dedicated security email shown in the panel below. For non-security enquiries, use Contact.