Connossieur24 Logo

Security Policy

Last updated September 29, 2026

At Connossieur24, we take the security of our systems, our data, and our users very seriously. As a platform dedicated to cybersecurity education and awareness, we deeply value the role that independent security researchers play in the broader internet ecosystem.

If you believe you have discovered a vulnerability in our application, infrastructure, or services, we ask that you disclose it to us responsibly.

Safe Harbor

We consider activities conducted consistent with this policy to constitute "authorized" conduct. We will not initiate legal action or law enforcement investigation against you for identifying or reporting a security vulnerability, provided that you comply with this Responsible Disclosure Policy.

Rules of Engagement

When conducting vulnerability research against Connossieur24, you must adhere to the following rules:

  • Do no harm: Do not exploit any vulnerability beyond what is strictly necessary to prove its existence.
  • Protect user data: You must not access, modify, delete, or exfiltrate any data that does not belong to you. If you encounter user data, stop testing immediately and report the issue.
  • No disruptions: Do not perform Denial of Service (DoS/DDoS) attacks, spamming, or any activity that degrades the reliability of our platform.
  • No social engineering: Phishing, vishing, spam, and physical attacks against our employees, users, or infrastructure providers are strictly prohibited.
  • Keep it confidential: Do not publicly disclose the vulnerability or share it with third parties until we have confirmed it is patched and given you explicit permission to do so.

Scope

In-Scope

  • The main web application hosted at connossieur24.com and its subdomains.
  • Platform authentication and authorization mechanisms.
  • Data isolation and tenant-level security controls.

Out-of-Scope

The following targets and vulnerability types are explicitly out of scope:

  • Third-party services and infrastructure (e.g., Vercel, Neon Database, HaveIBeenPwned API). Please report vulnerabilities in these services directly to their respective vendors.
  • Clickjacking on pages with no sensitive actions.
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
  • Attacks requiring MITM or physical access to a user's device.
  • Missing HTTP security headers that do not directly lead to a vulnerability.

How to Report a Vulnerability

If you have found a qualifying vulnerability, please send an email to connossieur24@yahoo.com.

To help us triage and resolve the issue quickly, please include the following in your report:

  • A clear description of the vulnerability and its potential impact.
  • Detailed, step-by-step instructions to reproduce the issue.
  • Proof of Concept (PoC) scripts, screenshots, or video recordings if applicable.
  • Your name or handle (for our internal records and potential future acknowledgments).

Our Commitment

If you choose to share your findings with us under this policy, we commit to:

  • Acknowledging the receipt of your vulnerability report within 3 business days.
  • Providing an estimated timeline for triage and remediation.
  • Notifying you when the vulnerability has been patched.
  • Maintaining an open and respectful dialogue with you throughout the process.

Note: As Connossieur24 is currently in its closed-beta MVP phase, we do not currently operate a paid bug bounty program. However, we are immensely grateful for valid reports and are happy to provide recommendations or acknowledgments for impactful discoveries.