# 🔐 Responsible Disclosure Policy

Effective Date: October 16, 2025

## Our Commitment

Corporation of Light DBA TheGAVL is committed to security. We appreciate the security research community's efforts to help us maintain the security of our Service. This policy outlines how to report vulnerabilities responsibly.

We welcome security researchers and ethical hackers to help us identify and fix vulnerabilities.

## Scope

This policy applies to:

- red-team-tools.aios.is (and all subdomains)
- workofarttattoo.github.io/AioS/
- TheGAVL Red Team Tools web application
- Associated APIs and backend services
- Mobile applications (if any)

### In-Scope Vulnerabilities

- Cross-Site Scripting (XSS)
- SQL Injection
- Authentication bypass
- Authorization flaws (IDOR, privilege escalation)
- Server-Side Request Forgery (SSRF)
- Remote Code Execution (RCE)
- XML External Entity (XXE)
- Cross-Site Request Forgery (CSRF)
- Insecure Direct Object References (IDOR)
- Server misconfigurations
- Sensitive data exposure
- Logic flaws

### Out of Scope

- Denial of Service (DoS/DDoS) attacks
- Social engineering attacks
- Physical security issues
- Third-party services (report to them directly)
- Vulnerabilities requiring physical access
- Clickjacking on pages without authentication
- Missing security headers without demonstrated impact
- Theoretical vulnerabilities without proof-of-concept

## How to Report a Vulnerability

### 📧 Security Contact

Email: security@thegavl.com

PGP Key: Available upon request for encrypted communication

Response Time: We aim to respond within 48 hours

### Report Contents

Please include the following in your report:

1. Summary: Brief description of the vulnerability
2. Steps to Reproduce: Detailed steps to reproduce the issue
3. Impact: Potential impact and severity assessment
4. Proof of Concept: Code, screenshots, or video demonstration
5. Environment: Browser, OS, and other relevant details
6. Remediation: Suggested fixes (optional)
7. Your Contact Info: Email for follow-up communication

## Our Response Process

### Timeline

1. Initial Response: Within 48 hours of report
2. Triage: Within 5 business days - confirm or request more info
3. Fix Development: 30-90 days depending on severity
4. Deployment: Critical issues patched within 7-14 days
5. Disclosure: Coordinated disclosure after fix deployment

### Severity Levels

- Critical: RCE, authentication bypass - 7 day fix target
- High: Authorization bypass, major data exposure - 30 day fix target
- Medium: XSS, CSRF, logic flaws - 60 day fix target
- Low: Information disclosure, minor issues - 90 day fix target

## Safe Harbor

### ⚠️ Legal Protection for Researchers

If you comply with this policy, we will:

- Not pursue legal action against you
- Work with you to understand and resolve the issue quickly
- Acknowledge your contribution (if you wish)
- Consider you to have acted in good faith

### Testing Guidelines

When testing, you MUST:

- Only test on your own account
- Not access, modify, or delete other users' data
- Not perform attacks that degrade service availability
- Not use automated scanners that generate excessive traffic
- Not publicly disclose the vulnerability before we've patched it
- Not violate any laws in your jurisdiction

## Coordinated Disclosure

We practice coordinated disclosure:

- Give us reasonable time to fix the issue (90 days standard)
- We'll coordinate with you on public disclosure timing
- We may publish a security advisory crediting you (if you wish)
- You may publish your findings after coordination

## Recognition

For valid vulnerability reports, we offer:

- Public Recognition: Listed in our security acknowledgments (optional)
- Hall of Fame: Featured on our security researchers page
- Swag: Branded merchandise for significant findings
- References: Professional reference letters for researchers

Note: We currently do not offer monetary bug bounties, but we greatly appreciate your contributions to our security.

## Example Report Template

`Subject: [SECURITY] XSS Vulnerability in Dashboard Summary: Stored XSS vulnerability in user profile name field allows execution of arbitrary JavaScript in other users' browsers. Severity: High Steps to Reproduce: 1. Log in to dashboard 2. Navigate to profile settings 3. Enter payload in name field: <script>alert(document.cookie)</script> 4. Save profile 5. View profile as another user - script executes Impact: - Session hijacking - Account takeover - Phishing attacks Proof of Concept: [Screenshot or video link] Suggested Fix: Sanitize user input with DOMPurify before rendering Contact: researcher@example.com`

## Questions?

If you have questions about this policy or the disclosure process:

- Security: security@thegavl.com
- Legal: legal@thegavl.com

Last Updated: October 16, 2025

← Back to Home