Vulnerability Disclosure Program

We value the security research community. Report vulnerabilities responsibly and help us protect our clients and infrastructure.

How to Report a Vulnerability

Choose your preferred secure communication method

Email (PGP Encrypted)

Recommended for all reports, encrypt your email using our PGP public key before sending.

View PGP Public Key

Email (Standard)

Send your vulnerability report via email. All communications are transmitted over TLS 1.3.

What to Include in Your Report

1. Vulnerability Description

Provide a clear, concise description of the vulnerability.

Example: "SQL injection vulnerability in the login form allows unauthorized database access."

2. Affected System/Service

Specify which system, URL, or service is affected.

Example: "https://portal.example.com/login – Login authentication endpoint"

3. Steps to Reproduce

Provide detailed steps so we can verify the vulnerability.

Example: 1. Navigate to https://portal.example.com/login 2. Enter username: admin' OR '1'='1 3. Enter any password 4. Click "Login" 5. Observe unauthorized access granted

4. Impact Assessment

Explain what an attacker could achieve by exploiting this vulnerability.

Example: "An attacker could gain unauthorized access to the admin panel, view sensitive client data, and potentially modify system configurations."

5. Supporting Materials (Optional)

Include screenshots, logs, or proof-of-concept code if available.

• Screenshots showing the vulnerability • Network traffic captures (sanitized) • Proof-of-concept code (non-weaponized)

6. Your Contact Information

Include your name or handle and preferred contact method so we can keep you updated and provide credit if desired.

PGP Public Key

Use this key to encrypt sensitive vulnerability reports before sending to security@isoutsource.com

Our Commitment to You

We follow industry best practices and provide legal safe harbor for good-faith researchers

What We Promise

Acknowledge your report within 5 business days
Provide initial assessment within 10 business days
Keep you informed throughout the remediation process
Publicly credit you (if desired) after resolution
No legal action for good-faith security research

What We Ask

Avoid accessing or modifying client data
Do not impact service availability or performance
Respect privacy and confidentiality of information
Allow 90 days for remediation before public disclosure
Report in good faith and follow responsible disclosure practices

Program Scope

Understanding what’s in scope helps you focus your research efforts

In Scope

✓ Public-facing systems and infrastructure
✓ Corporate systems and managed service tools
✓ Web applications and APIs
✓ Authentication and authorization systems
✓ ISOutsource-owned domains and subdomains
✓ Publicly exposed configuration files, metadata, and headers

Out of Scope

× Client environments (even with explicit authorization)
× Social engineering (phishing, vishing, etc.)
× Physical security testing of facilities
× Denial of Service (DoS/DDoS) attacks
× Third-party services not managed by us
× Spam or automated vulnerability scanning

This program follows industry best practices including ISO/IEC 29147, NIST SP 800-53, and CISA guidance.

For urgent security matters, contact: security@isoutsource.com

Vulnerability Disclosure Program

How to Report a Vulnerability

PGP Public Key

Our Commitment to You

Program Scope

Make IT Decisions with Confidence

Services

About

Support

Locations