Security & Vulnerability Disclosure

If you believe you have identified a security vulnerability affecting a CubeShackles public system, report it to security@cubeshackles.com. Please avoid transmitting unnecessary personal, customer, credential, or production-sensitive data in the initial report.

• Affected hostname, endpoint, application, repository, or asset.
• Clear reproduction steps and the conditions required to trigger the issue.
• Observed and expected behavior.
• A concise impact assessment and, where appropriate, proof-of-concept evidence.
• A secure contact method for follow-up.

We welcome good-faith research intended to improve the security of explicitly public CubeShackles systems. Researchers should minimize impact, avoid accessing data beyond what is necessary to demonstrate an issue, and stop testing if continued activity could affect availability, integrity, confidentiality, or third parties.

Unless otherwise stated in a specific security notice, only publicly reachable CubeShackles-owned web properties and services are considered in scope for responsible disclosure. Third-party infrastructure, customer environments, partner systems, private repositories, employee accounts, and non-public networks are not authorized targets.

• Denial-of-service, resource-exhaustion, or traffic-flooding activity.
• Social engineering, phishing, credential theft, or impersonation.
• Physical attacks or attempts to access facilities or devices.
• Destructive testing, persistence, lateral movement, or modification of data.
• Testing that targets customers, partners, employees, regulators, or third parties without explicit authorization.

Findings that generally do not demonstrate a meaningful security impact may include automated scanner output without validation, missing best-practice headers without an exploitable condition, clickjacking on non-sensitive pages, self-XSS, rate-limit observations without security consequence, and reports concerning software versions without evidence of exploitability in our environment.

We aim to acknowledge credible reports, triage severity, validate impact, coordinate remediation, and communicate material status updates where appropriate. Response timing depends on severity, reproducibility, affected systems, and operational constraints.

Please coordinate public disclosure with CubeShackles after a reasonable remediation period. Where disclosure could expose institutions, users, critical infrastructure, credentials, or unresolved exploitation paths, we may request additional time to complete remediation and validation.

CubeShackles designs security around least privilege, defense in depth, cryptographic integrity, auditability, segmentation, secure software development, observability, and incident readiness. Public descriptions intentionally remain high-level and do not expose sensitive implementation details.

Security-sensitive matters should be sent to security@cubeshackles.com. Non-security inquiries should use the appropriate channel on our Contact page.