RESPONSIBLE DISCLOSURE

Found something? Tell us.

We test other people's systems for a living, so we'd be hypocrites not to welcome reports about our own.

Last reviewed July 2026

Scope

This policy covers the Cybros website and the infrastructure we directly operate. It does not authorize testing of our clients' systems, or of third-party services we use.

How to report

Email security@gocybros.com with enough detail for us to reproduce the issue: affected URL or component, steps, and impact. Our security.txt is the canonical record of this contact.

What we promise

Acknowledgement within 2 business days.
An assessment and expected fix timeline within 7 business days.
Credit for the find, if you want it, once the issue is fixed.
No legal action for good-faith research that respects this policy (safe harbor).

Ground rules

Do not access, modify, or exfiltrate data that isn't yours; use test data to demonstrate impact.
No denial-of-service, spam, physical, or social-engineering attacks.
Give us reasonable time to fix before public disclosure.