Account security

Protect your sign-in

Your Proofsec account may provide access to research programs, submitted findings, private communications, team sessions and other sensitive information. Protecting your sign-in credentials is therefore an important part of protecting your research activity.

Use a strong, unique password that you do not reuse on other services. Reusing passwords increases the risk that a compromise of an unrelated website could also expose your Proofsec account.

Never share your password, session cookies, recovery codes, authentication tokens or other sign-in secrets with teammates, organization representatives or support contacts. Legitimate troubleshooting should not require you to disclose credentials that grant access to your account.

Enable multi-factor authentication if it is available in your account settings. Where possible, protect the email account associated with Proofsec with its own unique password and multi-factor authentication.

Use a trusted device and a secure connection when signing in. Avoid entering credentials on unfamiliar devices, through links from unexpected messages or on pages whose domain you have not verified.

Sign out when using a shared device. Do not rely exclusively on closing a browser window to terminate an authenticated session, particularly on a device that other people can access.

Keep your browser, operating system, password manager and other security-relevant software updated. Updates can address vulnerabilities that could otherwise expose saved credentials or active sessions.

• Use a unique password generated or stored by a reputable password manager.
• Enable available multi-factor authentication and securely store recovery codes.
• Verify the website address before entering credentials.
• Never disclose session cookies, access tokens or recovery secrets.
• Sign out from devices that you no longer control.

Protect your email and recovery methods

Your associated email account may be used for account notifications, password resets or other recovery operations, depending on the features supported by Proofsec. If someone gains control of that email account, they may be able to interfere with your Proofsec account as well.

Secure your email account with a unique password and multi-factor authentication where available. Review its recovery addresses, phone numbers, forwarding rules and active sessions periodically.

Treat password-reset messages, verification codes and account-recovery links as sensitive information. Do not forward them to other people or enter them into websites reached through suspicious messages.

Be cautious of messages claiming that your account will be suspended, that a report requires urgent action or that an administrator needs your credentials. Verify unusual requests through a trusted, independently accessed channel.

Keep recovery information current so that you can regain access if you lose a device or authentication method. Store backup codes in a secure location separate from the device they protect.

• Review active sessions on your email account.
• Check that recovery details still belong to you.
• Do not approve unexpected authentication prompts.
• Verify urgent account requests through a trusted channel.

Protect your devices and browser

Devices used for security research can contain source code, screenshots, browser profiles, authentication material, logs and confidential program information. A compromised or shared device can expose more than your Proofsec credentials.

Apply operating system and application updates promptly. Use a device lock, a strong authentication method and full-disk encryption where supported and appropriate.

Install software and browser extensions only when you trust their source and understand the permissions they request. Extensions that can read website content may be able to access information displayed in authenticated sessions.

Avoid saving passwords or sensitive research files on public or unmanaged computers. If you must access your account from a shared device, do not save credentials, remove downloaded files when appropriate and sign out before leaving.

Do not assume that private browsing, clearing browser history or closing a tab removes downloaded files, server-side records, active sessions or copies already shared with collaborators.

When practical, separate your everyday browsing environment from your security-testing environment. Keep research tools and working directories organized so that confidential artifacts are less likely to be exposed accidentally.

• Lock your device when it is unattended.
• Install software from trusted sources and review extension permissions.
• Avoid conducting sensitive work on public computers.
• Keep research artifacts out of shared or automatically synchronized folders unless their access controls are appropriate.
• Remove unnecessary local copies when retention is no longer required and deletion is permitted.

Protect research secrets

Security research can involve sensitive requests, proof-of-concept code, credentials, API keys, private program details, internal hostnames, logs and screenshots. Handle these materials according to the program's disclosure requirements and the sensitivity of the information they contain.

Redact passwords, session cookies, bearer tokens, private keys, personal information and unrelated customer data before uploading reports, screenshots, logs or code snippets. Replace secrets with clearly labeled placeholders when the original value is not necessary to reproduce the issue.

Include enough evidence to demonstrate a finding without collecting or disclosing unnecessary data. Prefer minimal, reproducible proof over large dumps, complete databases or screenshots containing unrelated information.

Store working files only in locations you control or are explicitly authorized to use. Restrict access to research directories, avoid public repositories for private findings and check whether synchronization or backup services could make sensitive files available to unintended recipients.

Do not upload confidential material to external services, code assistants, paste sites, file-sharing platforms or public issue trackers unless the program permits it and the service is appropriate for the data involved.

Use descriptive filenames and organized directories to distinguish public examples from confidential evidence. Before sharing an archive, inspect its contents for hidden files, configuration files, credentials, metadata and unrelated artifacts.

Remove temporary copies when they are no longer needed and deletion is permitted. Follow applicable program instructions and retention requirements when evidence must be preserved for triage or investigation.

• Redact secrets and unrelated personal data before submitting evidence.
• Use the minimum data necessary to reproduce the vulnerability.
• Keep private findings out of public repositories and paste services.
• Check files and archives before sharing them.
• Restrict access to local research material and backups.

Use programs and targets safely

Account security and research security are connected. A valid Proofsec account does not automatically authorize testing every asset associated with an organization. Review the individual program's scope, exclusions, testing conditions and disclosure instructions before interacting with a target.

Do not use another person's account, credentials, session or private research material to gain access to a target or platform feature. Do not test with credentials or data unless their use is explicitly authorized.

If a vulnerability exposes secrets or personal information, stop once you have enough evidence to establish the issue. Avoid expanding access, downloading additional records or using exposed credentials beyond what is necessary and explicitly permitted to verify the finding.

Keep test accounts and research artifacts separate from personal accounts and unrelated systems where practical. Document the steps needed to reproduce an issue without including live credentials or other reusable secrets.

If a program's authorization or scope is unclear, request clarification through its designated communication channel before proceeding with the uncertain activity.

• Verify scope and exclusions before testing.
• Use only accounts and credentials you are authorized to use.
• Minimize access to sensitive data and stop when sufficient evidence has been collected.
• Do not publish private findings without the required authorization.
• Keep reproduction steps useful without exposing reusable secrets.

Use sessions and team collaboration safely

Collaborative research can make it easier to coordinate testing, review evidence and reproduce findings. It also creates additional opportunities for accidental disclosure if access and file-sharing practices are unclear.

Invite only the people you intend to collaborate with. Before sharing sensitive material, confirm that the recipient is part of the relevant team and is permitted to access the associated program and evidence.

Do not paste credentials, private keys, session cookies, customer records or unnecessary personal information into shared chat. Use redacted examples and controlled secret-sharing mechanisms when sensitive values must be exchanged and such exchange is authorized.

Check the destination before uploading a file, sharing a code snippet or sending a message. Confirm whether a conversation or workspace is private, who can access it and whether membership changes affect access to previously shared material.

Use version control and clear ownership for collaborative code and evidence. Avoid overwriting another researcher's work, and communicate before making changes that could invalidate reproduction steps or destroy useful evidence.

If a team member leaves a project or no longer requires access, remove their access where the platform provides that control and review any external locations where team material was shared.

Do not assume that removing a message, leaving a session or deleting a local file removes copies already downloaded, exported, backed up or retained by other participants.

• Confirm recipients and access permissions before sharing.
• Do not place secrets or unnecessary personal data in shared chat.
• Review file destinations and session membership.
• Preserve reproducible evidence and communicate significant changes.
• Review access when team membership changes.

Recognize phishing and social engineering

Attackers may impersonate Proofsec staff, organization representatives, program owners or other researchers to obtain credentials, private findings or access to team sessions. A message may appear legitimate while directing you to a fraudulent sign-in page or an unauthorized file-sharing location.

Treat unexpected requests for passwords, recovery codes, session cookies, private keys or authentication tokens as suspicious. Do not disclose these values, even when the sender claims to be resolving an urgent issue.

Inspect links before opening them and verify the actual destination domain. Be cautious of misspellings, misleading subdomains, unexpected redirects, unfamiliar attachments and requests to install software or browser extensions.

Verify unusual requests using a separate, trusted communication channel rather than replying directly to the suspicious message. If a request involves a private vulnerability report, confirm that the recipient and disclosure channel are appropriate for that program.

Report suspected phishing or impersonation through an available, published Proofsec contact channel. Include relevant non-sensitive details, such as the sender, timestamp and suspicious destination, without forwarding live credentials or exposing additional confidential data.

• Verify unexpected requests independently.
• Do not open suspicious attachments or install untrusted software.
• Never provide authentication secrets to someone claiming to be support.
• Report impersonation and suspicious messages through a trusted channel.

If you suspect account compromise

Act promptly if you notice unfamiliar sign-ins, unexpected password-reset messages, unknown sessions, changes to account settings, messages you did not send or research material accessed without your permission.

Use a trusted device to change your Proofsec password and any reused passwords on other services. If the platform provides session management, revoke unfamiliar sessions or sign out other devices. If available, rotate compromised API keys or other credentials and invalidate exposed recovery codes.

Secure the email account associated with Proofsec. Review its sessions, recovery details, forwarding rules and recent security events. An attacker who retains control of your email may be able to regain access after you change your Proofsec password.

Preserve relevant timestamps, suspicious notifications, unfamiliar session details and other non-sensitive evidence. Avoid deleting information that may be needed to investigate the incident, but do not preserve or circulate exposed secrets unnecessarily.

If you cannot access your account, use the official recovery process or a published support channel. Provide enough information to explain the incident without sending passwords, authentication codes or session cookies.

If the incident may affect a private program, a research team or submitted evidence, assess what information could have been exposed. Notify the relevant parties through an appropriate trusted channel when necessary, while avoiding public disclosure of the vulnerability or confidential data.

If you suspect a vulnerability in Proofsec itself, report it privately through the platform's published responsible-disclosure channel. Include concise reproduction steps and impact details while avoiding unnecessary access to other users' information.

• Change compromised credentials from a trusted device.
• Revoke active sessions and rotate exposed secrets where the relevant controls are available.
• Secure your email account and review recovery settings.
• Preserve timestamps and relevant evidence.
• Contact Proofsec through an official channel if recovery or investigation is needed.
• Report suspected platform vulnerabilities privately.

Report suspicious activity

Report suspicious account activity, suspected unauthorized access or unexpected exposure of research material through an official Proofsec support or security contact channel, when one is available.

A useful report identifies the affected account or feature, the approximate time of the event, what you observed, the steps already taken and the potential information or access involved. Include relevant screenshots or logs only after removing passwords, tokens, personal information and unrelated confidential material.

Do not assume that an issue has been resolved until you receive confirmation through an appropriate channel. If the incident involves credentials or active sessions, take the available containment steps first rather than waiting for a response.

For vulnerabilities in Proofsec itself, follow the published responsible-disclosure instructions. Do not publish exploit details, private user information or sensitive evidence before disclosure is authorized.

• Use a verified, official contact channel.
• Include timestamps, affected features and reproducible observations.
• Redact secrets and unrelated personal information from attachments.
• Describe containment steps already taken.
• Keep platform vulnerability details private until disclosure is authorized.

Security limitations and availability of controls

Security controls vary by platform implementation and account configuration. Recommendations in this guide describe protective practices; they do not imply that Proofsec currently provides every mentioned feature.

Features such as multi-factor authentication, active-session management, recovery-code management, device management, account activity logs, file access controls and credential revocation should be used only where they are actually available.

If a recommended control is not available, apply the relevant protection at the service or device level where possible and contact Proofsec through a published channel if the missing control affects your ability to protect your account.

No single measure guarantees complete security. Account protection depends on the security of your devices, email account, credentials, recovery methods, collaboration practices and the services used to store or transmit research material.

Security checklist

• I use a unique password for Proofsec.
• I have secured the email account associated with Proofsec.
• I enable multi-factor authentication wherever it is available.
• I keep my devices, browser and security software updated.
• I verify program scope before testing targets.
• I redact secrets and unnecessary personal information from evidence.
• I check recipients and permissions before sharing files or messages.
• I know how to access official account recovery and security-reporting channels.
• I understand that not every security control described in this guide is necessarily implemented on Proofsec.