Security Policy

Send a concise description, the affected URL or feature, potential impact, and safe reproduction steps. Remove personal data and secrets from screenshots or supporting material.

Monitored security contact: clientservices@shadownodebureau.com

Do not send passwords, authentication codes, session cookies, private keys, payment credentials, client evidence, or unnecessary personal information in the initial report.

This policy does not grant blanket authorization to test ShadowNode or any third-party system. Do not perform destructive testing, denial-of-service or load testing, social engineering, phishing, physical intrusion, privacy violations, bulk data extraction, persistence, credential attacks, malware deployment, or access to another person’s account or information.

Stop testing if you encounter personal information, client material, credentials, or evidence. Do not download, retain, alter, disclose, or redistribute it. Report the issue promptly and delete any inadvertently received data after receiving safe handling instructions.

We aim to acknowledge useful reports and coordinate remediation where practical. We ask researchers to act in good faith, minimize impact, preserve confidentiality, and allow reasonable time for investigation before public disclosure.

ShadowNode will consider good-faith compliance with this policy when evaluating a report. This statement is not immunity, legal advice, or a promise that conduct is lawful in every jurisdiction. Researchers remain responsible for complying with applicable law and should seek independent legal advice when uncertain.

Our controls include authenticated sessions, role and ownership checks, two-factor authentication options, protected credentials, private storage, audit records, and server-side payment verification. Controls evolve with risk, and no system can be guaranteed completely secure.