Security Brigade values the work of independent security researchers and the broader cybersecurity community. If you believe you have discovered a security vulnerability in the Coconut Security Dashboard or any Security Brigade system, we encourage you to report it to us responsibly.
2. Scope
This policy applies to vulnerabilities discovered in:
The Coconut Security Dashboard (dash.securitybrigade.com)
Security Brigade's public-facing web properties (securitybrigade.com)
APIs and services operated by Security Brigade
The following are out of scope:
Social engineering attacks against Security Brigade employees or clients.
Denial-of-service (DoS/DDoS) attacks.
Physical attacks against Security Brigade offices or infrastructure.
Vulnerabilities in third-party software not directly operated by Security Brigade.
Issues already known to us or previously reported by another researcher.
3. How to Report
Send your report to [email protected] with the following information:
A clear description of the vulnerability and its potential impact.
Detailed steps to reproduce the issue.
Any supporting evidence (screenshots, proof-of-concept code, HTTP requests/responses).
Your contact information for follow-up.
If the vulnerability involves sensitive data, we recommend encrypting your report. Contact us for our PGP key.
4. What We Commit To
Acknowledgement: We will acknowledge receipt of your report within 2 business days.
Assessment: We will assess the report and provide an initial evaluation within 5 business days.
Resolution: We will work to resolve validated vulnerabilities within a reasonable timeframe, typically 30–90 days depending on severity and complexity.
Communication: We will keep you informed of the remediation progress and notify you when the fix is deployed.
Credit: With your permission, we will publicly acknowledge your contribution in our security advisories.
5. Safe Harbour
If you comply with this policy, Security Brigade commits to:
Not pursuing legal action against you for your research activities.
Not reporting your activities to law enforcement, provided they are conducted in good faith.
Working with you to understand and resolve the issue.
To qualify for safe harbour protection, you must:
Make a good-faith effort to avoid privacy violations, data destruction, and service disruption.
Not access or modify data belonging to other users or clients.
Stop testing and report the vulnerability immediately upon discovering sensitive data.
Not disclose the vulnerability publicly until we have had a reasonable opportunity to remediate it.
6. What We Ask
Do not exploit the vulnerability beyond what is necessary to demonstrate the issue.
Do not exfiltrate, retain, or share client data.
Allow us reasonable time to remediate before any public disclosure.
Act in good faith and in accordance with applicable law, including the Information Technology Act, 2000.
7. Contact
Email: [email protected]
Subject line: [Responsible Disclosure] Brief description of the vulnerability