DEFCON2TECH LLC
RESPONSIBLE DISCLOSURE POLICY

Version: 1.0
Effective date: September 4, 2026
Owner: DEFCON2TECH LLC
Review cycle: At least annually

1. REPORTING A VULNERABILITY

DEFCON2TECH welcomes good-faith reports of security vulnerabilities affecting
dc2tech.com and publicly operated DEFCON2TECH services.

Send reports to security@dc2tech.com. For sensitive report content, first arrange an
encrypted exchange through secure@dc2tech.com using the process at
https://dc2tech.com/#verify.

Please include:

* the affected URL, service, or asset;
* a clear description of the issue and its potential impact;
* reproducible steps or a proof of concept that minimizes impact;
* any relevant timestamps, request/response details, or screenshots; and
* a way to contact you for follow-up.

2. GOOD-FAITH RESEARCH

While investigating, please:

* avoid privacy violations, service disruption, data destruction, and modification of
  data;
* use only accounts and data you own or for which you have explicit authorization;
* stop testing if you encounter non-public data or any condition that could affect
  availability; and
* do not use social engineering, phishing, physical intrusion, denial-of-service,
  credential attacks, or automated high-volume scanning.

3. OUT OF SCOPE

Third-party services, client systems, and systems not owned or explicitly operated by
DEFCON2TECH are out of scope. Do not test them unless you have separate written
authorization from their owner.

4. OUR RESPONSE

DEFCON2TECH will review reports in good faith, may request additional information, and
will work to validate and remediate confirmed issues as appropriate. Do not publicly
disclose a vulnerability or publish exploit details until DEFCON2TECH has confirmed
that remediation is complete or both parties have agreed on coordinated disclosure.

5. LIMITATIONS

This policy does not grant permission to access non-public information, bypass access
controls, or conduct activity prohibited by law. It does not create a bounty program,
compensation obligation, or contractual relationship.