Agreement and acceptance
By creating, publishing or managing an organization or security research program on Proofsec, you agree to these Organization Terms and to the applicable platform rules, program requirements and Rules of Engagement.
If you use Proofsec on behalf of a company, institution or another legal entity, these terms apply to your organization. You confirm that you have the authority to accept them and to make commitments on the organization's behalf.
You are responsible for ensuring that employees, contractors and other representatives who manage your organization or program understand and follow the applicable requirements.
If you do not agree with these terms or cannot meet the obligations associated with your program, do not publish or continue operating that program.
Authority and verification
You confirm that you are authorized to represent your organization and to permit security testing of the assets you list. You must have the necessary ownership, permission or delegated authority before making any asset available for research.
Proofsec may request information needed to verify your organization, your authority to represent it or your right to authorize testing of listed assets. You must provide accurate information and cooperate with reasonable verification requests.
Keep your organization name, representative details, contact information and other submitted information accurate and up to date. Correct outdated or misleading information promptly.
You must not impersonate another organization, misrepresent your relationship with an asset owner or publish a program without the necessary authorization.
Proofsec may refuse, restrict, suspend or remove an organization or program when verification fails, information is materially inaccurate, authorization is unclear or continued operation presents a security or platform-integrity risk.
Defining your program
A security research program must describe its purpose, authorized targets, testing restrictions, reporting process and any reward conditions that apply. Researchers must be able to understand the program before beginning work.
Program descriptions must be accurate, specific and consistent with the permissions your organization can grant. Do not promise access, rewards, response times or protections that your organization cannot provide.
Identify the systems, domains, applications, APIs, services and other assets that are explicitly in scope. Where relevant, distinguish production systems from staging, development and testing environments.
Clearly document exclusions, prohibited techniques, testing windows, rate limits, account requirements, data-handling restrictions and other operational conditions. If a restriction is important to safe testing, do not leave it ambiguous.
If your program depends on additional policies, contractual requirements or third-party permissions, make the relevant conditions available to researchers before they begin testing.
You are responsible for reviewing the published program and ensuring that its rules accurately reflect the authorization granted by your organization.
Scope and third-party assets
List only assets that your organization owns or is authorized to include in the program. A technical relationship with an asset, such as using its API or hosting provider, does not automatically give you authority to authorize testing of it.
For assets operated by cloud providers, external vendors, business partners or other third parties, verify that the relevant agreements and provider policies permit the proposed testing.
Clearly identify out-of-scope assets and services. Do not rely on researchers to infer exclusions from branding, shared infrastructure, DNS records or technical relationships.
If you discover that an asset cannot be tested under the permissions available to your organization, remove it from scope or obtain the necessary authorization before allowing further research.
Review scope whenever your infrastructure, vendors, ownership or permissions change. Notify researchers of material changes and ensure that the published scope remains accurate.
If a researcher reports a potential vulnerability in an asset that is outside your authority, explain the limitation clearly and, where appropriate, direct the matter to the responsible asset owner without disclosing unnecessary researcher information.
Rules of Engagement
Every program must establish clear Rules of Engagement that describe what researchers are permitted to do and which activities are prohibited.
Restrictions should address relevant risks, including denial-of-service testing, social engineering, phishing, physical access attempts, destructive actions, persistence, automated scanning intensity and access to sensitive data.
If certain testing techniques require prior approval, specify the approval process and the conditions under which permission may be granted. Silence or the absence of an explicit prohibition must not be used to imply authorization for high-impact activity.
You must not encourage researchers to access, modify, delete or disclose data beyond what is reasonably necessary to demonstrate a finding. Program rules should favor minimal-impact validation.
When a researcher appears to have exceeded the program's authorization, assess the available evidence fairly, consider the published rules and communicate the specific concern. Do not assume malicious intent solely because a report describes a serious vulnerability.
Changes to the Rules of Engagement must be communicated clearly. Do not retroactively apply newly introduced restrictions to conduct that was permitted under the rules in effect when it occurred.
Safe harbor commitment
Your organization commits not to pursue legal action against researchers who act in good faith, remain within the authorized scope and follow the published Rules of Engagement.
You must communicate this commitment to the legal, security, compliance and other internal teams responsible for handling security research. Internal procedures should support the safe harbor commitment rather than undermine it.
The commitment applies only to conduct covered by the authorization and applicable program rules. It does not grant permission to access unrelated systems, misuse data, disrupt services or continue testing after authorization has been withdrawn.
If a report raises a concern about potentially out-of-scope activity, review the circumstances and the applicable authorization before taking action. Distinguish good-faith research from conduct that falls outside the program's protections.
Describe the limits of your safe harbor commitment clearly in the program. Do not imply that Proofsec itself grants legal authorization on your organization's behalf or guarantees immunity from claims by unrelated third parties.
Researcher treatment and non-retaliation
Treat researchers professionally and evaluate their reports based on technical evidence, program scope and published requirements.
Do not threaten, harass, discriminate against or retaliate against a researcher for submitting a good-faith report within the program's authorization.
Do not attempt to identify a researcher beyond the information legitimately provided through the platform or required for an agreed administrative purpose.
Limit access to researcher identity and contact information to personnel who need it to review reports, communicate with the researcher, administer rewards or meet a legitimate organizational obligation.
Do not use a researcher's findings, account information or private communications for purposes unrelated to the program without an appropriate basis and authorization.
If a dispute arises, provide a factual explanation of your decision and use the available platform processes to resolve the issue.
Triage and communication
Your organization is responsible for reviewing reports submitted to its programs and providing clear, accurate and timely communication.
Publish a realistic response-time target where the platform supports it. Treat published targets as operational commitments and inform researchers when a material delay affects their report.
Assess reports using the available evidence, reproducibility, affected assets, security impact, program scope and applicable rules. Request additional information when necessary, but avoid unnecessary requests that delay a reasonable assessment.
Provide a clear decision for each report, such as accepted, duplicate, informative or rejected, where those statuses are supported by the platform. Explain the material reason for the decision.
When rejecting a report, identify the relevant issue, such as insufficient evidence, lack of demonstrated security impact, an out-of-scope asset or a previously reported finding. Do not rely solely on an unexplained status.
When marking a report as a duplicate, provide enough information to explain the decision without revealing another researcher's confidential information.
Keep communications focused on the report. Do not pressure researchers to withdraw valid findings or change their conclusions for reasons unrelated to technical accuracy.
If the review process requires additional time, communicate the delay and provide an update when reasonably possible.
Report assessment and consistency
Apply the program's published criteria consistently across researchers and reports. Similar findings should be assessed using comparable technical and impact criteria, taking relevant differences into account.
Evaluate the actual security impact rather than relying exclusively on a vulnerability title, scanner output, severity label or proof-of-concept description.
Distinguish a confirmed vulnerability from a theoretical concern, a configuration observation or a report that lacks enough evidence for a reliable conclusion.
If the researcher supplies new evidence that materially changes the assessment, reconsider the decision where appropriate.
Document the reasoning behind material triage decisions so that your organization can explain its conclusions and maintain a consistent review process.
Do not change the program's evaluation criteria solely to avoid accepting a valid report or paying a reward that was promised under the applicable terms.
Rewards and payment commitments
If your program offers monetary or other rewards, publish the applicable reward ranges, eligibility conditions, severity criteria and any material exclusions before researchers begin testing.
Assess rewards according to the published program terms, the demonstrated impact and the evidence available. Clearly explain how a final reward was determined when a report is accepted.
Maintain sufficient internal approval and funding processes to meet the reward commitments made through your program.
Once a reward has been accepted and confirmed under the applicable program terms, do not reduce or withdraw it unilaterally except where the published terms permit the change or a documented error, fraud or other material issue justifies review.
Do not retroactively introduce eligibility restrictions or change reward criteria to avoid a payment that was due under the terms applicable when the report was submitted.
Communicate any required information, verification steps or payment dependencies to the researcher through the appropriate process. Request only information reasonably necessary for the relevant payment or compliance requirement.
Proofsec's exact payment workflow, platform fees, payout methods and processing times depend on the arrangements available for the relevant program. Do not promise a particular payout method or processing deadline unless it has been confirmed.
Your organization remains responsible for fulfilling the reward obligations it has undertaken. The platform's role in facilitating a program does not automatically transfer every payment obligation to Proofsec.
Confidentiality and data handling
Treat submitted reports, proof-of-concept material, supporting files, researcher communications and non-public researcher details as confidential unless disclosure is authorized or required by an applicable obligation.
Limit access to report content to personnel who need it for triage, remediation, risk management, legal review or program administration.
Use submitted information for security assessment and related program purposes. Do not repurpose sensitive report material for unrelated activities without an appropriate basis.
Handle credentials, personal information, customer records, tokens, internal documents and other sensitive data according to your organization's security requirements and applicable obligations.
Do not request that researchers collect or transmit unnecessary sensitive information to demonstrate a vulnerability. Prefer minimal evidence, redacted examples and controlled reproduction steps.
Securely store and share report material. Avoid placing confidential findings in public tickets, unrestricted repositories, general-purpose chat channels or other locations accessible to unauthorized personnel.
If a report exposes sensitive information, take reasonable steps to restrict further access and address the underlying exposure.
Disclosure and publication
Coordinate vulnerability disclosure with the researcher and agree on a reasonable timeline that considers remediation progress, severity, exploitation risk and the needs of affected users.
Provide researchers with meaningful status updates when disclosure timing depends on remediation or other material developments.
Do not disclose a researcher's identity, private communications or confidential report details without an appropriate basis or authorization.
Do not impose indefinite confidentiality solely to avoid reputational consequences. Any restriction on disclosure should have a reasonable, clearly communicated justification.
Where an issue has been resolved, do not unreasonably prevent a researcher from discussing the finding in a way consistent with the agreed disclosure terms and applicable confidentiality obligations.
Before publication, coordinate the removal of secrets, personal data, exploitable credentials and other information that could unnecessarily expose users or systems.
If an issue remains unresolved and poses a material risk, discuss a proportionate extension of the disclosure timeline with the researcher and explain the reasons for the request.
Proofsec does not automatically guarantee a particular disclosure date or determine every disclosure dispute. The parties remain responsible for the commitments and applicable requirements that govern their agreement.
Remediation and incident response
Your organization is responsible for investigating, prioritizing and remediating vulnerabilities reported through its program.
Maintain an internal process for assigning findings to appropriate owners, tracking remediation work and verifying fixes before treating an issue as resolved.
Prioritize remediation based on demonstrated impact, exposure, exploitability, affected assets and the potential consequences for users and systems.
If a report indicates active exploitation, exposed credentials, unauthorized access or an immediate risk to users, follow your incident-response procedures without waiting for the ordinary triage process to finish.
Where appropriate, ask the researcher for clarification or a minimal reproduction that helps confirm the issue. Do not require unnecessary additional testing when the available evidence already demonstrates the risk.
After deploying a fix, validate that the vulnerability is addressed and consider whether related assets or systems may be affected.
Proofsec provides the platform for coordinating research and reports; it does not perform remediation on your behalf or guarantee that your systems are secure.
Privacy and researcher information
Use researcher information only for legitimate program operations, report assessment, communication, reward administration and other purposes disclosed through the applicable platform processes.
Restrict access to personal information according to role and need. Ensure that employees, contractors and external reviewers who can access confidential material follow your organization's security and confidentiality requirements.
Do not publish personal information, attempt to deanonymize researchers or share their details with unrelated parties without an appropriate basis.
If your program requires identity verification or additional information for a specific purpose, explain the requirement and use an appropriate process to collect it.
Retain reports and related information only as appropriate for the program, remediation, security, compliance and other legitimate operational needs, subject to applicable requirements.
Your organization is responsible for its own handling of information obtained through the program. Do not assume that using Proofsec removes your organization's privacy or data-protection responsibilities.
Organization accounts and access control
Keep organization accounts and program-management access limited to authorized personnel. Each person with administrative access should have a legitimate operational reason to use it.
Protect account credentials, secure the email accounts used for administration and remove access when an employee, contractor or other representative no longer requires it.
Do not share individual login credentials where separate accounts or supported access controls are available.
Review administrative permissions periodically, especially after personnel changes, suspected account compromise or changes in organizational responsibilities.
Notify the appropriate platform contact if you suspect unauthorized access to your organization account, program settings or confidential reports.
You are responsible for the actions taken by representatives using access that your organization has granted, subject to the applicable platform terms and circumstances.
Program changes, pauses and closure
You may update, pause or close a program using the functionality available on Proofsec, subject to applicable platform terms and any outstanding commitments.
Communicate material changes to scope, Rules of Engagement, reward criteria, contact details or program availability clearly and promptly.
Do not use a pause or closure to avoid reviewing reports already submitted or fulfilling obligations that arose under the applicable program terms.
Reports submitted before a program change or closure must still be assessed according to the terms that apply to those reports, including any applicable reward commitments.
When a program is paused or closed, communicate whether testing must stop immediately and whether researchers should cease ongoing activity. Researchers must not assume that previous authorization remains valid indefinitely after a program has ended.
If an organization loses authorization over an asset, remove it from scope and notify affected researchers as soon as reasonably possible.
Preserve the information necessary to complete outstanding triage, remediation, reward administration and agreed disclosure activities.
Plans, fees and billing
Any subscription plan, platform fee, usage limit, billing schedule or paid feature that applies to your organization will be described in the applicable plan information, order, checkout flow or separate agreement.
Review the terms presented before purchasing a plan or activating a paid service. Do not assume that a feature, fee waiver, discount or service level is included unless it has been expressly stated.
Your organization is responsible for maintaining accurate billing information and paying fees that are properly due under the applicable arrangement.
Changes to plan availability, pricing or included functionality are governed by the terms communicated for the relevant service and any applicable agreement.
If a billing question or dispute arises, use the designated support or billing process and provide the relevant transaction or account details without sending passwords or other authentication secrets.
No specific price, fee, refund policy, payout processing time or service-level commitment is established by this document unless it is separately stated in the applicable terms.
Platform availability and Proofsec's role
Proofsec provides a platform for organizing security research programs, communicating findings and coordinating interactions between organizations and researchers.
The availability of individual features depends on the functionality released for your account and program. Do not assume that every possible workflow, integration, automation or payment option is available.
Proofsec does not guarantee that every report will identify a valid vulnerability, that every program will receive submissions or that a particular security outcome will be achieved.
Your organization remains responsible for the security of its assets, the accuracy of its program information, the permissions it grants, its triage decisions and its remediation work.
You must not use Proofsec to distribute misleading program information, solicit unauthorized activity, interfere with another party's systems or misuse researcher submissions.
Nothing in these terms transfers ownership of your systems or gives Proofsec authority to authorize testing of assets that your organization does not control.
Misuse, suspension and enforcement
You must not use the platform to deceive researchers, publish programs without proper authorization, withhold agreed rewards without a valid basis, retaliate against researchers or obtain information through misleading program rules.
You must not manipulate report outcomes, misrepresent remediation status or use duplicate classifications and other program decisions in bad faith.
Proofsec may review reports of misuse, request clarification, restrict program functionality or suspend or remove an organization or program when necessary to protect platform integrity, researchers or affected parties.
Where appropriate, Proofsec may request supporting information before deciding how to handle a reported issue. The availability and scope of any review process depend on the applicable platform procedures.
If your organization believes that a platform decision is incorrect, use the designated support or review channel and provide a concise explanation with relevant evidence.
Suspension or removal from the platform does not automatically cancel outstanding obligations that your organization has already undertaken.
Intellectual property and submitted material
Your organization retains its rights in its systems, documentation, software and other materials, subject to the rights and permissions held by third parties.
Researchers retain any rights they hold in their original report text, research notes, proof-of-concept material and other independently created content, subject to applicable law and the agreements governing the program.
By receiving a report, your organization may use the information reasonably necessary to investigate, reproduce, remediate and verify the reported vulnerability, subject to the applicable terms and confidentiality obligations.
Do not assume that submitting a report transfers ownership of all research material or grants unrestricted rights to publish it, redistribute it or use it for unrelated purposes.
If broader licensing, attribution or publication rights are required, establish them clearly with the relevant researcher before relying on them.
Conflicts and interpretation
If these Organization Terms conflict with the specific terms of a program, the applicable platform terms or a separate written agreement, the conflict must be assessed in light of the relevant documents, their scope and any applicable precedence rules.
Program-specific rules may clarify operational requirements, scope and rewards, but should not be treated as permission to disregard higher-priority platform terms or applicable obligations.
If a requirement is unclear, seek clarification through the appropriate Proofsec support channel before relying on an interpretation that materially affects researcher authorization, confidentiality or rewards.
Nothing in this document is intended to grant authority over third-party systems, waive obligations that cannot legally be waived or replace independent legal advice where it is required.
Updates to these terms
Proofsec may update these terms as the platform, its features and its operational requirements evolve.
Where a change materially affects organization obligations, the updated terms should be made available through the relevant platform or communication channel.
Review the version and effective date of the terms applicable to your organization. If you cannot accept a material change, use the available support or account process to clarify its effect on your program.
Changes to these terms do not automatically rewrite reward commitments, authorizations or other obligations that already arose under an earlier version. The effect of a change depends on the applicable terms and circumstances.
Contact and support
For questions about organization verification, program configuration, scope, report handling, billing or platform access, use the official support channel provided by Proofsec.
When contacting support, include the organization or program identifier and a concise description of the issue. Include report references or relevant evidence when necessary.
Do not include passwords, private authentication keys, active access tokens or unnecessary personal information in support requests.
For urgent security incidents affecting your own infrastructure, follow your organization's incident-response procedures in parallel with any platform communication.
Organization compliance checklist
- Confirm that your organization and its representatives are accurately identified.
- Verify that you have authority to authorize testing of every in-scope asset.
- Publish clear scope, exclusions and Rules of Engagement.
- Define realistic triage expectations and maintain a reliable contact process.
- Publish reward criteria and ensure that accepted rewards can be fulfilled.
- Communicate the safe harbor commitment to internal legal and security teams.
- Protect report contents, researcher information and administrative accounts.
- Evaluate reports consistently and provide clear reasons for decisions.
- Coordinate disclosure and track remediation through resolution.
- Honor outstanding report, confidentiality and reward commitments when changing or closing a program.