Vulnerability disclosure

Scope

The isecpath.com web application and its authenticated APIs. Third-party providers are out of scope — report those to the provider directly.

Rules of engagement

Test only against your own account. Do not access, modify or exfiltrate other users' data. No denial of service, no social engineering of staff or learners, no physical testing, and no automated scanning that degrades service.

Stop as soon as you have proof of concept, and report it.

What to include

Affected endpoint or feature, reproduction steps, impact, and any evidence. Reports are triaged by severity; we will acknowledge receipt and keep you updated through resolution.

Safe harbour

We will not pursue action against good-faith research that follows this policy. Acting outside it — including accessing other learners' data — is not covered.

Unresolved dependencies

The security reporting address, PGP key, response-time targets and any reward programme are not yet established for this deployment and will be published here once defined. Until then, report through support and mark it as a security issue.