Vulnerability Disclosure Policy

1. How to report a vulnerability

Email security@sh4dowcorp.com. English and Spanish are both fine. To help us triage quickly, please include:

• the affected URL or component and the type of issue;
• step-by-step instructions to reproduce it, with a proof of concept if you have one;
• the impact you think it has, and any preconditions an attacker would need;
• how you would like to be credited, if at all.

Please report one issue per email, and do not include other people’s personal data or any data you obtained beyond what you need to show the issue. We do not run a paid bug bounty program.

2. Scope

In scope: the website sh4dowcorp.com, including its pages, forms, and the API routes those forms use.

Out of scope:

• our service providers’ platforms (hosting, database, email, DNS, and anti-bot checks; see Subprocessors). Report issues in their systems to them directly;
• our clients’ systems, under any circumstances;
• other domains we own, such as sh4dowintel.com, which this policy does not cover yet. If you notice something there in passing, tell us, but do not test them;
• findings without a demonstrated security impact, such as missing security headers on their own, banner or version disclosure, email sender policy (SPF, DKIM, DMARC) reports, clickjacking on pages without sensitive actions, and output from automated scanners that you have not validated.

3. Testing rules

When you test our website, please:

• access, modify, or delete no data beyond the minimum needed to show the issue, and stop once you have shown it;
• not degrade the service: no denial of service, load testing, or high-volume automated scanning;
• not use social engineering, phishing, or physical attacks against our team or our offices;
• not submit spam or bulk entries through our forms, including the Complaints Book;
• keep the details confidential until we have fixed the issue or agreed a disclosure date with you.

4. Safe harbor

If you report in good faith and follow this policy, we will acknowledge your report and will not pursue legal action against you, to the extent the decision is ours. If a third party raises a complaint about research that followed this policy, we will confirm, if asked, that it did. This policy covers only sh4dowcorp.com and does not authorize testing of any other system, as also set out in section 5 of our Terms of Use. If you are unsure whether something is allowed, ask us first.

5. What to expect from us

We are a small team. These are the targets we work to:

Acknowledgement

Within 3 business days of your report

Initial assessment

Within 10 business days: whether we can reproduce it and how severe we think it is

Status updates

At least every 30 days until the issue is resolved

Disclosure

Coordinated with you; by default once a fix ships, or after 90 days if we have not agreed otherwise

We will tell you when the issue is fixed and, with your permission, credit you by name when we mention the fix publicly. If we decide a report is not a vulnerability or is out of scope, we will tell you why.

6. Encryption

We do not publish a PGP key yet. Most email between mail providers travels over TLS, but that is not end-to-end encryption. If your report includes sensitive details, such as credentials or personal data, leave them out of your first email: we will agree a secure way to exchange them with you. We will update this page and our security.txt when we publish a key.

7. Active security incidents

This address is for vulnerability reports about our website. If your organization is dealing with an active security incident and needs help, contact our incident response team instead:

8. security.txt

Our contact details are also published in machine-readable form at /.well-known/security.txt, following RFC 9116. It points back to this page as our policy.