Vulnerability Disclosure Policy

Vulnerability Disclosure Policy

Last Updated: October 6, 2026

1. Our Commitment

We welcome good-faith reports of security vulnerabilities in our public web properties. If you follow this policy, we will work with you to understand and resolve the issue.

2. Scope

In scope:

  • www.beeasyenterprises.com and beeasyenterprises.com

Out of scope:

  • Third-party services we use (GitHub, EmailJS, Google reCAPTCHA); please report issues to the relevant provider
  • Denial-of-service testing, volumetric attacks, or anything that degrades availability
  • Social engineering, phishing, or physical attacks against our people or facilities
  • Findings that require access to accounts or data that are not yours
  • Missing HTTP response headers that GitHub Pages does not let us set (we mitigate with a page-level content security policy)

3. Rules of Engagement

  • Test only against systems in scope, and use the least access needed to demonstrate the issue.
  • Do not access, modify, copy, or destroy data that is not yours. If you encounter personal or sensitive data, stop and tell us.
  • Do not use automated scanning that creates significant load.
  • Give us reasonable time to remediate before public disclosure, and do not publish personal data or exploit details beyond what is needed to describe the issue.

4. Safe Harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue or support legal action against you for it, and we will work to resolve the issue with you. This policy does not authorize violating the law, and it does not bind third parties. If legal action is initiated by a third party, we will make clear that your research was conducted in line with this policy.

5. How to Report

Email security@beeasyenterprises.com with:

  • A description of the vulnerability and its potential impact
  • The affected URL or component and clear steps to reproduce
  • Any proof-of-concept material, with sensitive data removed
  • Your preferred contact method and whether you would like public credit

We do not currently publish a PGP key. If you need an encrypted channel, say so in your first message and we will arrange one. Our security.txt file lists the same contact.

6. What to Expect

  • Acknowledgment within 3 business days
  • An initial assessment and severity rating within 10 business days
  • Updates as we investigate, and notice when the issue is resolved
  • Credit in our acknowledgment if you want it. We do not run a paid bounty program.