Vulnerability Disclosure Policy

GBCORP takes the security of its products, services, and customer data seriously. We welcome reports from security researchers, customers, and the public about vulnerabilities discovered in our systems. This Vulnerability Disclosure Policy explains how to report a vulnerability and what to expect from GBCORP in return.

1) Scope — In

This Policy covers vulnerabilities in the following GBCORP-operated assets:

• gbcorp.org and any subdomain of gbcorp.org
• Every site in the GBCORP network: gbcorp.solutions, gbcorp.io, gbcorp.cloud, gbcorp.tech, gbcorp.ai, gbcorp.shop, gbcorp.store, gbcorp.education, gbcorp.academy, gbcorp.university, gbcorp.llc, gbcorp.ltd, gbcorp.us, i-dua.com, and subdomains thereof
• GBCORP-published mobile applications
• Public-facing APIs operated by GBCORP

2) Scope — Out

The following are out of scope. Please do NOT test or report:

• Third-party services we use but do not operate (e.g., Stripe, Cloudflare, Google Workspace) — please report directly to the relevant vendor
• Physical attacks against GBCORP staff or property
• Social-engineering attacks against GBCORP staff or customers
• Denial-of-service or volumetric attacks
• Findings from automated scanners without verification
• Best-practice issues without demonstrated impact (e.g., missing security headers without a working exploit)
• Issues in third-party software outside our control (CMS plugins, etc.) — report to that vendor and let us know

3) How to Report

Submit your report by email to [email protected]. PGP encryption is supported on request — send an initial message with the subject line "PGP key request" and our public key will be provided.

Please include in your report:

• A clear description of the vulnerability
• The affected URL or system
• Steps to reproduce, with proof-of-concept code or screenshots where possible
• Your assessment of impact
• Whether you intend to publish your findings, and your preferred disclosure timeline

4) Safe Harbor

GBCORP will not pursue or support legal action against researchers who, in good faith, comply with this Policy. Specifically, if your security research is consistent with this Policy, GBCORP will consider it:

• Authorised under applicable computer-misuse and anti-hacking laws (including the United States Computer Fraud and Abuse Act and equivalent international statutes)
• Authorised under the Digital Millennium Copyright Act for circumventing technological protection measures to access GBCORP systems
• Exempt from any restrictions in our Terms of Use that would otherwise prohibit the activity

To remain within scope of this safe harbor, you must:

• Make a good-faith effort to avoid privacy violations, destruction of data, and interruption or degradation of services
• Only access data and systems to the extent necessary to demonstrate the vulnerability
• Not exfiltrate, store, or share GBCORP or customer data beyond what is necessary to demonstrate the vulnerability
• Give GBCORP a reasonable opportunity to investigate and remediate before public disclosure

5) What to Expect

When you submit a valid report, GBCORP will:

• Acknowledge receipt within 5 business days
• Triage and confirm or close the report within 15 business days
• Communicate with you on progress at reasonable intervals during investigation
• Credit you (with your consent) in our published security advisory

6) Coordinated Disclosure

We aim to resolve high-severity vulnerabilities within 60 days of confirmation and lower-severity vulnerabilities within 90 days. Where this is not possible (e.g., upstream dependency), we will keep you informed.

Please coordinate public disclosure with us. We will not unreasonably delay your right to publish; equally, we ask that you not disclose details before a fix is available.

7) Recognition

GBCORP does not currently operate a paid bug-bounty programme. We may publish a Hall of Fame recognising researchers (with their consent) who have helped us improve our security.

8) Contact

Security reports: [email protected]

For all non-security enquiries please use [email protected].