Vulnerability Disclosure Policy

1. Purpose

Bitscaled LLC welcomes good-faith reports of security vulnerabilities in systems we operate. This policy describes scope, how to report, and the safe harbor we offer researchers who follow it. It is a coordinated disclosure policy, not a paid bug bounty.

2. In-scope systems

You may research and report vulnerabilities in Bitscaled-operated properties, including:

• https://bitscaled.tech (public website).
• vaulttools.bitscaled.tech (VaultTools gateway and Bitscaled-operated tool services).
• spooftest.bitscaled.tech (VaultSandbox, when that service is offered).
• Client Workspace, Intranet, and Admin portals that Bitscaled operates, limited to Bitscaled's own implementation — not a customer's Microsoft 365 tenant, endpoints, or other environment.

Use only accounts you own or that we explicitly authorize. Do not access another organization's Workspace data.

3. Out of scope

The following are not authorized and are not covered by safe harbor:

• Unauthorized testing of customer or client environments, third-party tenants, or systems Bitscaled manages for a client.
• Scanning, spoofing, or credential testing of domains, IPs, or mailboxes you are not authorized to assess, including via VaultTools or VaultSandbox.
• Physical attacks, social engineering of Bitscaled staff or clients, or phishing.
• Denial of service, resource exhaustion, or spam against Bitscaled or client systems.
• Exfiltration, copying, or retention of data beyond the minimum needed to demonstrate a vulnerability.
• Third-party products, vendor portals, or public cloud control planes we do not operate, except for a bug in Bitscaled's own integration code.

4. How to report

Email a clear report to security@bitscaled.tech and copy legal@bitscaled.tech. Include the affected URL or host, a description of the issue, steps to reproduce, impact, and any proof that does not include extra personal data.

Encrypted email is optional. If you need a PGP key, request one from security@bitscaled.tech. We do not publish a fingerprint on this page.

Give us a reasonable time to investigate and fix before public disclosure. We will try to acknowledge receipt. We may ask follow-up questions. Do not demand payment as a condition of disclosing a vulnerability.

5. Rules of engagement

• Stop testing if you encounter data that is not yours; report what you saw and delete local copies.
• Do not exfiltrate data. A screenshot or a single crafted request that proves the bug is enough.
• Do not degrade service (no DoS, no flooding, no ransomware-style encryption).
• Do not socially engineer Bitscaled staff, contractors, or clients.
• Do not use findings to access, change, or destroy data beyond what is necessary to demonstrate the issue.
• Comply with United States law. This policy does not authorize research that is otherwise illegal.

6. Safe harbor

If you conduct research in good faith, stay in scope, follow this policy, and do not exploit a finding beyond demonstration, Bitscaled will not bring a civil action against you or refer the matter to law enforcement for that research. We cannot bind third parties or prosecutors. If a third party takes action, we will make it known that you followed this policy.

Safe harbor does not apply to out-of-scope testing, extortion, public disclosure made to pressure payment, or harm to clients or other users.

7. No paid bug bounty

Bitscaled does not operate a paid bug bounty program. We may thank researchers who report in-scope issues. We do not offer payment, swag with a stated value, or points unless we expressly agree in writing before the research begins. Absence of a bounty does not reduce the expectation that you follow this policy.

8. Contact

Security: security@bitscaled.tech. Legal: legal@bitscaled.tech.