Responsible Disclosure

Scope

This policy applies to the following in-scope assets:

• fortressmssp.com — primary web property and all subdomains
• Web application functionality hosted at fortressmssp.com (contact forms, API endpoints, authentication flows if applicable)

Any assets or systems not explicitly listed above are out of scope. Do not test systems belonging to our clients, partners, or infrastructure providers.

Out of Scope

The following activities are explicitly out of scope and will not be considered for acknowledgement. Engaging in these activities may forfeit safe harbor protections:

• Denial of service (DoS) or distributed denial of service (DDoS) attacks against any Fortress MSSP property
• Social engineering, phishing, vishing, or pretexting attacks targeting Fortress MSSP staff, contractors, or clients
• Physical security testing of Fortress MSSP facilities or offices
• Automated scanning that generates excessive traffic or degrades service availability
• Vulnerabilities in third-party services, software, or platforms that we use but do not control (report these to the respective vendor)
• Clickjacking on pages with no sensitive functionality
• Missing security headers that do not directly lead to exploitability
• SPF, DKIM, or DMARC misconfigurations that do not represent an active threat
• Publicly known vulnerabilities in unpatched third-party software where no proof-of-concept exploitation is demonstrated

How to Report a Vulnerability

To report a vulnerability, send an email to our dedicated security address:

Please include as much of the following information as possible to help us triage and validate your report efficiently:

• Affected URL or asset — the exact URL, endpoint, parameter, or asset where the vulnerability was found
• Vulnerability type — e.g., XSS, SQL injection, IDOR, authentication bypass, SSRF
• Description — a clear and concise explanation of the vulnerability and the conditions required to trigger it
• Steps to reproduce — a numbered, step-by-step reproduction path that we can follow to confirm the finding
• Proof of concept — screenshots, HTTP request/response pairs, or a working PoC (where safe to demonstrate without causing damage)
• Impact assessment — your evaluation of what an attacker could achieve by exploiting this vulnerability
• Suggested remediation — optional, but appreciated if you have a recommendation

Our Commitments to You

When you submit a vulnerability report in good faith and in accordance with this policy, Fortress MSSP commits to the following:

• Acknowledgement within 2 business days

  We will send an initial acknowledgement confirming receipt of your report within two (2) business days.

• Prompt investigation

  We will investigate reported vulnerabilities promptly and keep you informed of our progress. Complex findings may require additional time; we will communicate expected timelines.

• Transparent communication

  We will notify you when the vulnerability has been validated, when remediation is in progress, and when it has been resolved.

• No legal action for good-faith research

  We will not pursue civil or criminal action against researchers who discover and report vulnerabilities in good faith, in accordance with this policy, and without exceeding the scope defined herein.

• Credit and acknowledgement

  If you wish to be credited for your finding in our security acknowledgements, we will honor that request. If you prefer to remain anonymous, we will respect that too.

Safe Harbor Statement

Fortress MSSP supports good-faith security research conducted in accordance with this policy. We consider activities meeting all of the following criteria to be authorized:

• Testing is limited to the assets explicitly listed in the Scope section above
• No data is exfiltrated, modified, or destroyed — you stop testing and report immediately upon discovering sensitive data access
• Testing does not degrade service availability for legitimate users
• Testing does not involve social engineering, physical intrusion, or harm to individuals
• You promptly report the vulnerability to [email protected] and do not disclose it publicly prior to remediation

Coordinated Disclosure Timeline

We request that researchers allow Fortress MSSP a reasonable period to investigate and remediate reported vulnerabilities before any public disclosure. We aim to resolve critical and high-severity findings within 30 days and medium or lower-severity findings within 90 days. If a finding requires more time due to complexity or dependency on third parties, we will communicate this and agree on a disclosure timeline collaboratively.