Security policy
Found a security issue? Tell us.
We welcome reports from security researchers. If you believe you’ve found a vulnerability in our website or our client portal, please let us know.
Scope
What this covers
www.cyberwayus.com, the Cyber Way client portal, and our email domain, cyberwayus.com.
Out of scope
- Denial of service, or anything that degrades the service for others
- Social engineering of our people, clients or partners, and physical attacks
- Services we use but don’t operate, such as our email provider
- Reports from automated scanners without a demonstrated impact
Testing in good faith
How to test, and our promise to you
- Access only what you need to show the issue, and never another person’s data.
- Don’t change or delete anything, and stop as soon as you’ve confirmed the issue.
- Keep it confidential until we’ve fixed it, and give us reasonable time to do so.
- Keep testing light. No high-volume automated scanning.
Safe harbor. If you act in good faith and follow this policy, we consider your research authorized, we won’t take legal action against you for it, and we’ll work with you to understand and fix the issue.
Reporting
How to tell us
Send your report through our contact form and choose “Reporting a security issue”. Include what you found, where, and the steps to reproduce it. We acknowledge every report and keep you updated.
We don’t run a paid bug bounty, but we’re glad to thank you publicly if you’d like.