Responsible Disclosure & Security Safe Harbor
At WebDefect, we prioritize infrastructure integrity and customer safety. If you believe you have discovered a potential security vulnerability, we invite you to report it to our security operations team in accordance with this disclosure standard.
Our Safe Harbor Commitment
If you conduct vulnerability research in good faith and adhere strictly to these guidelines, we will not initiate legal action against you, nor will we pursue law enforcement complaints related to your authorized research activities. We view security researchers as indispensable partners in maintaining Internet defense.
Assessment Scope
In Scope
- webdefect.com and all direct subdomains
- The external scanning core and public API endpoints
- User authentication, session tokens, and customer account portals
- Report generation pipelines and export artifacts
Out of Scope (Strictly Prohibited)
- Denial of Service (DoS/DDoS) attacks against our infrastructure or scanned targets
- Social engineering, phishing, or physical attacks against employees
- Destruction, exfiltration, or modification of user or target data
- Third-party cloud infrastructure and CDN providers (e.g. AWS, Cloudflare)
Submission Protocol & Response SLA
To report an issue, transmit your findings via encrypted email to:
Please include in your report:
- Clear summary of the vulnerability, potential CVSS impact, and affected endpoint(s)
- Reproducible step-by-step instructions or cURL proof-of-concept (PoC)
- Recommendations for containment or remediation
- Your name or handle if you wish to be acknowledged in our security hall of fame
PGP Public Key
Encrypt sensitive vulnerability reports to our security team using this PGP key. Key ID: 4096R/0x7E8F9A2B3C4D5E6F · Fingerprint: 8A9B 7C6D 5E4F 3A2B 1C0D 9E8F 7A6B 5C4D 3E2F 1A0B
# Generate 4096-bit RSA key gpg --full-generate-key # Choose: (1) RSA and RSA # Key size: 4096 # Expiration: 2 years # Name: WebDefect Security Team # Email: [email protected] # Export public key gpg --armor --export [email protected] > security-key.asc # Publish to keyservers gpg --send-keys [KEY_ID] # Also upload to keys.openpgp.org
-----BEGIN PGP PUBLIC KEY BLOCK----- Comment: This is a PLACEHOLDER key - Replace with real key generated by WebDefect team mQINBGcOh5sBEADXk2Yw8vN5pL9rT6hF3qV8nW7eK2pM9cR4jS1fH6dE5yU3gB7w L2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM 3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9 yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2q P4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF 8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5 nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9e L3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW 6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8 uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7g H2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM 1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6 rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9p Q4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wARAQ AQALQi5XZWJEZWZlY3QgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAd2ViZGVmZWN0 LmNvbT6JAk4EEwEKADgWIQSKm3xtXk86Kxww2e96a1xNPi8aCwUCZw6HmwIbAwUL CQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRB6a1xNPi8aC3gvD/9rT6hF3qV8nW7e K2pM9cR4jS1fH6dE5yU3gB7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL 3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6 tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8u V4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH 2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6rY3jM1 cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ4sE6r Y3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8nT9pQ 4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7wL2vK8 nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM3gH7w L2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9yU6rM 3gH7wL2vK8nT9pQ4sE6rY3jM1cF7gH2kN8uV4pW6tR9eL3mJ5nK7dF8vT2qP4sE9 =8K2p -----END PGP PUBLIC KEY BLOCK-----
Note: This placeholder key will NOT decrypt messages.
Until a real key is published, please send unencrypted vulnerability reports to [email protected] or use our contact form.