Data Science & Engineering Experts, Inc. ("DSE"), a Delaware corporation registered to do business in Georgia, welcomes reports of security vulnerabilities from researchers, clients, and the public. This policy explains what is in scope, how to report an issue, how to test without causing harm, and what you can expect from us.
Scope
This policy covers the following systems operated by DSE:
- www.thedataexperts.us, including its forms, the API it calls under
/prod/, and the/govcon/directory. - privatestackhub.com, limited to its public pages and sign-up flow.
- app.privatestackhub.com, only inside a workspace you created yourself, using test data you created. Do not try to reach any other workspace or tenant, even to demonstrate a cross-tenant issue.
The following are out of scope:
- Workspaces, data, or systems belonging to DSE clients or other PrivateStack customers.
- Third-party services we use, such as our cloud, email, payment, and help-desk providers. Do not test those providers. If you believe our own configuration of one of them is the problem, report that to us.
- Country editions of our website and any DSE system not listed above.
- Findings with no demonstrated security impact, such as missing email authentication records, banner or version disclosure, or unvalidated scanner output.
How to report
Email contact@thedataexperts.us with "Security report" in the subject line. Please include:
- The affected URL or endpoint.
- A description of the issue and its security impact.
- Benign steps to reproduce it, using only accounts and data you control.
- Anything you accessed by accident while testing.
Do not include passwords, keys, session tokens, or personal data in your first email. Describe them and we will arrange a secure channel if they need to change hands. Anonymous reports are accepted.
Testing rules
- Use only accounts, workspaces, and data that you own or have explicit permission to use.
- Do not access, change, or delete other people's data. If you encounter personal or customer data, stop, and tell us what happened without keeping or sending the data itself.
- Do not degrade or interrupt service. No denial-of-service testing, high-volume automated scanning, or bulk form submissions.
- Do not use phishing, social engineering, or physical access against DSE staff, clients, or premises.
- Do not access cloud metadata services, internal networks, administrative interfaces, or logs.
- Do not leave persistent access, backdoors, or test content behind.
- Agree a disclosure date with us before you publish anything about the issue. We use 90 days from your report as a starting point for that conversation, not as a deadline after which disclosure is automatic.
What to expect from us
- We aim to acknowledge your report within three business days.
- We aim to give you an initial assessment within ten business days of receiving enough detail to reproduce the issue.
- We keep you updated while we work on a fix, and tell you when it ships.
- With your permission, we credit you publicly once the issue is resolved.
Rewards
DSE does not run a bug bounty program and does not offer monetary rewards for vulnerability reports. Submitting a report does not create any right to payment. We do not agree to payment as a condition of receiving a report.
A report does not create a contract or any obligation beyond what this policy states. We may decline to respond to automated, untargeted, or duplicate reports, or reports with no demonstrated security impact.
Safe harbor
This safe harbor covers only research on the in-scope systems listed above, carried out under the testing rules above. It does not cover access to any other workspace, tenant, account, or data, and sending a report does not authorize further testing.
When conducting vulnerability research according to this policy, we consider this research conducted under this policy to be:
- Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this policy;
- Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls;
- Exempt from restrictions in our Terms of Service that would interfere with conducting security research, and we waive those restrictions on a limited basis; and
- Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through the address above before going any further.
Contact us
Data Science & Engineering Experts, Inc.
8735 Dunwoody Place #5714, Atlanta, GA 30350
Security reports: contact@thedataexperts.us
Machine-readable contact: security.txt