Security Disclosures

If you believe you have identified a vulnerability or security flaw impacting Empire Dots digital assets or web applications, submit your report to our dedicated security operations desk:

To enable rapid triage, all vulnerability submissions must contain complete, verifiable details:

• Vulnerability Classification: Classification type (e.g., OWASP Top 10, SSRF, IDOR, Remote Code Execution, Privilege Escalation).
• Reproduction Steps: Minimal, non-destructive step-by-step instructions or non-destructive Proof of Concept (PoC) code.
• Target Boundaries: Exact affected URLs, API endpoints, parameters, HTTP request and response samples.
• Impact Analysis: Realistic assessment of the security risk and potential operational impact.

This policy applies strictly to assets owned and directly operated by Empire Dots Global:

• In-Scope Assets: Public web properties hosted under the *.empiredots.com domain and official public open-source software libraries published by Empire Dots.
• Strictly Out-of-Scope (Client Assets): Dedicated client infrastructure, bespoke staging instances, and production client applications engineered by Empire Dots are under separate client ownership and governed by individual client MSAs. Research conducted against client systems without explicit written consent from the client constitutes an unauthorized intrusion and falls completely outside this Safe Harbor.

Engaging in any of the following methods immediately forfeits Safe Harbor protections and may result in referral to cybersecurity law enforcement:

• Denial of Service (DoS/DDoS): Volumetric attacks, resource starvation, or any intentional degradation of infrastructure performance.
• Social Engineering & Phishing: Spear-phishing, credential harvesting, pretexting, or physical access attempts targeting personnel or facilities.
• Data Modification or Exfiltration: Accessing, downloading, copying, modifying, destroying, or publicizing client or internal company records beyond the bare minimum required to establish proof of concept.
• Unthrottled Automated Scanning: Excessive automated vulnerability scanners that cause degradation to production servers.

Empire Dots considers security research conducted in strict accordance with this policy to be authorized within the scope of computer crime statutes (including the Computer Fraud and Abuse Act (CFAA) and equivalent international cybersecurity frameworks). We commit to the following protections:

• No Legal Action: We will not pursue civil lawsuits or initiate criminal complaints against you for good-faith, accidental, or incidental violations that comply with this policy.
• Defense Support: If a third party initiates legal action against you for research activities conducted strictly under this program, we will make it known that your conduct was authorized by Empire Dots.
• Mandatory Coordinated Embargo: You must maintain strict confidentiality and withhold public disclosure for at least ninety (90) calendar days following confirmation, or until mutual written agreement on coordinated disclosure.

Our security engineering squads remediate verified vulnerabilities under a priority-based SLA:

• Acknowledgment: Within 48 hours of report submission, assigning a tracking ticket and lead security engineer.
• Triage & Severity Grading: Validation and calculation of CVSS v3.1 severity scores within five (5) business days.
• Patch Deployment Target: Critical vulnerabilities (< 24 hours); High vulnerabilities (< 7 calendar days); Medium/Low vulnerabilities (within the subsequent agile release sprint).
• Recognition: Finders adhering to this policy may be publicly credited in our Security Hall of Fame or release changelogs upon verified remediation.

Unless expressly negotiated under a formal written Bug Bounty agreement executed prior to submission, Empire Dots operates this disclosure program without monetary compensation, cash bounties, or reward promises.

Researchers bear full responsibility for any expenses, software licenses, or tax liabilities incurred during security testing. Empire Dots assumes no liability for damages incurred by researchers during testing activities.

Empire Dots Global reserves the express right to modify, amend, update, suspend, or terminate this Security Disclosures & Vulnerability Program at any time at our sole discretion.

Any revisions take immediate effect upon publication on this page, as denoted by the "Last Updated" date at the top. Continued engagement in security testing or report submission following published updates constitutes binding agreement to the revised terms.