Vulnerability disclosure policy.
Found a security issue in our systems? Here's how to report it — and what you can expect from us.
01Reporting a vulnerability
Security is our business, and that includes our own systems. If you believe you've found a security vulnerability in the Grey Cybersecurity Solutions website or services, please tell us so we can fix it.
Send your report through our contact form — choose “Security vulnerability report” — or by email at . Please include a description of the issue and its potential impact, the steps needed to reproduce it, the affected URL or system, and any proof-of-concept code or screenshots.
02Guidelines for researchers
- Give us a reasonable amount of time to investigate and fix the issue before you disclose it publicly.
- Only test systems you're authorized to test, and stop as soon as you've confirmed a vulnerability.
- Don't access, modify or delete data that isn't yours, and don't keep any data you encounter.
- Don't degrade our services — no denial-of-service or high-volume automated testing.
- Don't use social engineering, phishing or physical attacks against our staff or offices.
03What you can expect from us
We'll acknowledge your report, keep you informed while we investigate, and let you know when the issue has been resolved. If you'd like, we'll credit you for the discovery once it's fixed.
04Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized and will not pursue legal action against you for it.
05Out of scope
Please don't report findings without a demonstrated security impact, such as automated scanner output, missing security headers, email authentication (SPF/DKIM/DMARC) settings, clickjacking on pages with no sensitive actions, or software version disclosure.
This is a vulnerability disclosure policy, not a bug bounty program: we don't offer payment for reports.