Vulnerability disclosure policy — hypervigilance.com

We run a website; you may find a flaw in it. This policy tells you how to report it and what you can expect from us. It is modeled on the practice the US government requires of its own agencies (CISA BOD 20-01) and on ISO/IEC 29147.

Scope. This policy covers hypervigilance.com — the public website and its form-intake endpoint (/api/engage). It does not cover: systems or tenants we operate for clients; our internal business systems; or third-party infrastructure (including Cloudflare's own platform — report Cloudflare issues to Cloudflare). If you are unsure whether something is in scope, ask first via the contact below.

Ground rules. Act in good faith: do not degrade or deny service; do not access, copy, or exfiltrate data beyond the minimum needed to demonstrate the issue; if you encounter personal information or any data that is not yours, stop and report immediately; no social engineering of our people; no physical intrusion; do not test systems that are out of scope.

How to report. Write to engage@hypervigilance.com — the monitored team mailbox, which is also the contact address published in this site's security.txt. Tell us what you found, where, how to reproduce it, and what you think the impact is. We accept anonymous reports, and we will never require personal information from a reporter.

What you can expect from us. We will acknowledge your report within three (3) business days. We will keep you informed as we investigate and fix. We do not operate a bug bounty and do not offer payment; we will credit you if you want credit.

Authorization and legal position. If you make a good-faith effort to follow this policy, we consider your research authorized, we will not recommend or pursue legal action against you for it, and if a third party raises action against you for activity this policy authorizes, we will make it known that your research was conducted under this policy. This is our commitment; we cannot bind prosecutors or third parties.

Disclosure. We ask that you give us a reasonable period to remediate before publishing details. This is a request, not a gag — we will work with you on timing.

Effective date: October 20, 2026. This policy is reviewed on the site's recorded review cycle.