Found a security issue? Tell us.

1. What is in scope

This policy covers vulnerabilities you find in:

• The www.agatecybersecurity.com website and any subdomain owned by Agate Cybersecurity LLC
• Forms, contact channels, and APIs on this site
• Any future Agate-hosted customer portal or commerce flow

2. What is out of scope

The following are out of scope under this policy, because they are operated by a third party or because the report is not actionable:

• Vulnerabilities in third-party services we depend on — please report those directly to the vendor that owns the service
• Social-engineering attempts (calling staff, phishing employees, pretexting)
• Denial-of-service or stress testing against our production systems
• Reports based purely on a security-scanner score with no demonstrated impact (e.g., "your SSL grade is A- instead of A+")
• Vulnerabilities that require physical access to our office or equipment
• Spam, phishing, or abuse coming from sources unrelated to Agate

If you are not sure whether something is in scope, please email us anyway. We would rather hear about it than not.

3. How to report

Send an email to security@agatecybersecurity.com with as much of the following as you can:

• A short description of the vulnerability
• The URL, endpoint, or system affected
• Steps to reproduce, including any payload
• What an attacker could do with it
• How you would like to be credited if a fix is published (optional)

If your report is sensitive and you want to encrypt it, ask us in your first email and we will arrange a key. We do not currently publish a permanent PGP key.

4. What we will do

When you send a report, we commit to:

• Acknowledge receipt within three (3) business days
• Triage and reply with our assessment within ten (10) business days
• Keep you informed through remediation
• Credit you when we publish a fix, if you want credit and the report turns out to be valid

Most of the time we will fix the issue, tell you when it is fixed, and ask whether you want a public mention. Sometimes a report turns out to be a duplicate, out of scope, or not a real issue — we will tell you that too and explain why.

5. Safe harbor — what we will not do to you

If you report a vulnerability to us in good faith and follow this policy, we will not:

• Pursue legal action against you under the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, or any other federal or state computer-crime law
• Pursue civil action against you for the act of finding or responsibly reporting the issue
• Contact your employer or report you to law enforcement for the act of finding or responsibly reporting the issue

"Good faith" means: you avoid violating the privacy of our users or customers, you avoid destroying or altering data, you avoid degrading service for others, you do not access data beyond what is needed to demonstrate the issue, and you give us a reasonable chance to fix it before any public disclosure.

If a security researcher follows this policy, Agate considers their research to be authorized under the relevant computer-crime laws. This safe harbor does not extend to deliberately destructive acts, extortion, or testing against systems we do not own.

6. Public disclosure

We ask that you give us a reasonable window to fix the issue before disclosing it publicly. The default window is ninety (90) days from your first report, or until we have shipped a fix — whichever comes first.

For issues that require a more involved fix (for example, ones that depend on a third-party vendor we cannot control), we may ask for additional time and will explain why. For low-impact issues, you may publish sooner if we agree.

7. What you will not get

To be straight with you: Agate Cybersecurity is a small business. We do not currently run a paid bug bounty program. We cannot pay rewards for valid reports.

What you will get is a real human response, real follow-through, a credit when you want one, and the safe harbor commitment above.

8. Changes

If we change this policy, we will update the "Last updated" date below and post the new version here. A change to this policy does not undo the safe harbor commitment for a report you have already sent us under the previous version.