Responsible Disclosure Policy

Email hello@cyberlions.ai with the affected URL or component, reproduction steps, and impact as you understand it. Screenshots, proof-of-concept requests and HAR captures help us triage faster. We acknowledge reports within 48 hours and aim to give a triage decision within 5 business days.

Do not include secrets, credentials or personal data in the initial report. If sensitive evidence is necessary, ask us to agree on a secure transfer method before sending it.

In scope: this website (cyberlions.ai), its subdomains, and the client-facing application — authentication flows, the AI threat console, training modules, the client portal and admin dashboard. Examples of what we care about: cross-site scripting, authentication or session bypass, broken access control (e.g. reading another client's training or audit records), injection, and exposure of API keys or secrets.

Out of scope: denial-of-service or volumetric attacks, spam or social engineering of our staff or clients, automated scanner output without a demonstrated issue, missing security headers without a concrete exploit, and self-XSS.

• Use only accounts and data you own or test accounts you created.
• Never access, modify or exfiltrate another client's data.
• Stop and report immediately if you encounter personal data.
• Do not run automated scans at rates that degrade the service.
• Do not establish persistence, install malware, alter records or move laterally after demonstrating the issue.
• Do not publicly disclose the vulnerability before we confirm remediation or an agreed disclosure date.

We will acknowledge a complete report within 48 hours, aim to complete initial severity triage within five business days, keep you informed at meaningful milestones and work toward remediation based on risk. Complex or third-party fixes may take longer; we will explain material delays.

If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorised, will not pursue legal action, and will not refer compliant research to law enforcement. This safe harbor does not cover unlawful conduct, privacy violations, disruption, extortion or activity outside this policy. We ask that you give us reasonable time to fix an issue before any public disclosure, and that you coordinate the disclosure with us.

We do not currently run a bug bounty with monetary rewards, but we will credit reporters who wish to be named once a fix is live — tell us in your report how you would like to be acknowledged.

Employees, contractors and vendors testing under a separate agreement must follow that agreement rather than this public policy. Reports must describe a reproducible security impact. Findings that rely only on outdated browsers, theoretical weaknesses, rate-limit observations without demonstrated harm, or third-party services outside our control may be closed without remediation.