Security Disclosure Policy

How to report a suspected vulnerability

Email tsh_cook@hotmail.com. Please do not include passwords, private keys, access tokens, customer data, or unnecessary personal information in the initial report.

Include the affected ELITZE-controlled URL or component, a concise description, reproducible steps, potential impact, relevant timestamps, and redacted evidence where available. If a report contains sensitive material, explain what it contains before sending additional details.

Safe research boundaries

• Test only systems you own or are explicitly authorized to assess.
• Stop when you have enough evidence to demonstrate the issue. Avoid data access beyond the minimum needed to validate impact.
• Do not perform denial-of-service testing, social engineering, destructive actions, persistence, or production data modification.
• Do not access customer environments or third-party systems through ELITZE unless you have separate explicit authorization.
• Keep suspected vulnerabilities private while a coordinated resolution is being discussed, where practical.

What happens after a report

Reports are intended to follow an intake, acknowledgement, triage, severity assessment, remediation, retest, and closure process. A report is not confirmation that a vulnerability exists or that a particular response time can be met. No bounty, contractual change, waiver, or authorization to exceed scope is created by submitting a report.

Scope and limitations

This channel is for suspected security issues in ELITZE-controlled services and product components. Do not submit unrelated personal information or confidential third-party material. If the affected asset is not controlled by ELITZE, report it to its owner.