Vulnerability Disclosure Policy

How to report

If you believe you have found a security vulnerability in anything we operate, please tell us. We would rather hear about it from you than from anyone else.

• Email: hello@nextgensec.io with the subject line Security vulnerability report.
• Machine-readable contact: /.well-known/security.txt, published per RFC 9116.
• Language: English or Arabic.

Helpful details: the affected URL or service, the steps to reproduce, the impact as you understand it, and any proof-of-concept. Please do not send us data belonging to other people. If you accessed someone else's data by accident, tell us what you saw and delete your copy.

Scope

In scope

• nextgensec.io and every page and form on it, including the contact form, the free readiness scan, the free domain scan, the AI helpdesk widget and the public attested-evidence pages.
• Email infrastructure for the nextgensec.io domain: SPF, DKIM, DMARC and related records.
• Deliverables we send clients, such as reports and evidence packs, where the flaw is in something we produced.

Out of scope

• Third-party hosting and providers. The site is hosted on shared infrastructure that we do not operate. Report flaws in the hosting provider, font or API providers to them directly.
• Denial of service, resource exhaustion, and volumetric testing of any kind.
• Social engineering of our staff, clients or partners, and physical attacks.
• Reports without a security impact: missing best-practice headers with no demonstrated effect, version disclosure alone, clickjacking on pages with no state-changing action, and automated-scanner output with no analysis.
• Client systems. We only ever assess client systems under a signed engagement. Never test a client's systems on our behalf.

Rules of engagement

• Do no harm. Do not degrade the service, alter or delete data, or access data that is not yours. Stop and report as soon as you have enough to demonstrate the issue.
• Minimal footprint. Use your own test accounts and submissions. Do not read, download or store other people's scan results, lead data or messages.
• No automated flooding. Rate-limited probing is fine; anything that looks like a load test is not.
• Keep it private until we have fixed the issue or the disclosure window below has passed.
• No extortion. Reports that condition disclosure on payment are not covered by this policy.

What to expect from us

• Acknowledgement within 3 business days.
• Triage and a severity assessment within 10 business days, with a named contact for follow-up.
• A fix or mitigation as fast as the severity warrants; critical issues in the live site are typically addressed within days.
• Honesty. We will tell you if we think a report is out of scope or not a vulnerability, and why.

We are a small firm and we do not currently run a paid bug-bounty programme. We will say so plainly rather than imply otherwise.

Safe harbour

If you make a good-faith effort to follow this policy, we will treat your research as authorised, we will not pursue or support legal action against you for it, and we will work with you to understand and resolve the issue. If a third party starts legal action against you for activity that complied with this policy, we will make it known that your actions were conducted in compliance with it.

This does not authorise testing of systems we do not operate, and it does not cover activity that breaks the rules above. If you are unsure whether something is covered, ask us first.

Coordinated disclosure

We ask for up to 90 days from acknowledgement before public disclosure, or sooner once a fix is deployed. If we need longer for a good reason, we will ask and explain. We will credit you in any public write-up unless you prefer to stay anonymous. We will not publish your report or personal details without your consent.

Recognition

Researchers who report valid, in-scope issues under this policy will be thanked by name (or handle) on this page if they wish. A public list will appear here once we have entries to show.