Security
Found a security issue? Tell us, and we'll take it seriously.
This is our vulnerability disclosure policy, what you may test, how to report it, what we promise in return, and how we credit researchers who help.
At a glance
How to report: Email security@sofloconsulting.net with steps to reproduce. This is the same address published in our security.txt.
What you can test: Systems we operate and control, using only accounts and data you own or are authorized to use.
What to avoid: No denial-of-service, no social engineering, no access to other users’ data, and no high-volume automated scanning.
What we promise: Acknowledgement within three business days, regular status updates, and safe harbor for good-faith research.
Credit: With your permission, we list valid reporters in our public acknowledgments, or keep you anonymous if you prefer.
Hiring: We are not posting security roles right now. The Hiring section below explains where future openings will appear.
0 of 9 expanded
Soflo Consulting, LLC ("Soflo Consulting," "we," "us," or "our") takes the security of our platform, our clients, and their data seriously. We welcome reports from security researchers and the public that help us identify and fix vulnerabilities. This page is our Vulnerability Disclosure Policy. It explains what you may test, how to report a suspected vulnerability, what you can expect from us in return, and how we credit researchers who help us improve. We will not pursue or support legal action against anyone who conducts security research in good faith and in accordance with this policy. Please read the entire page before you begin testing.
This policy applies to systems we operate and control. The list below is illustrative rather than exhaustive; if you are unsure whether a target is in scope, email us at security@sofloconsulting.net before you start.
In scope
- sofloconsulting.net and its subdomains that we operate
- Our web application, training portal, and authenticated user areas
- The public certificate-verification tool and our free interactive tools
Out of scope
- Third-party services and vendors we rely on (report to the vendor directly)
- Automated scanning that generates high volumes of traffic or degrades service
- Social engineering, phishing, or physical attacks against our staff or offices
- Denial-of-service testing, load testing, or any activity that disrupts availability
- Reports that rely only on missing "best practice" headers without a demonstrable impact
- Self-XSS, clickjacking on pages without sensitive actions, or reports from automated tools with no proof of exploitability
Testing is limited to accounts and data you own or are expressly authorized to use. Do not access, modify, exfiltrate, or retain the data of other users.
Send your report by email to security@sofloconsulting.net. This address is listed in our machine-readable security.txt file at /.well-known/security.txt.
Please do not open public issues, post to social media, or share details of an unreported vulnerability. Use email so we can triage, reproduce, and coordinate a fix with you.
If your report involves sensitive information, tell us and we will arrange a more secure channel for any proof-of-concept material.
A clear, reproducible report helps us fix issues faster. Where possible, include: • A description of the vulnerability and the type of issue; • The affected URL, endpoint, or component; • Step-by-step reproduction instructions, with the exact requests or inputs used; • A proof of concept (screenshots, video, or a minimal script) without exploiting real user data; • The potential impact and how it could be abused; • Any suggested mitigation, if you have one; and • Your preferred name and contact for credit (optional). Do not include large data dumps, real client data, or anything obtained beyond the minimum needed to demonstrate the issue.
We aim to make reporting straightforward and to keep you informed. Our typical targets are: • Acknowledgement of your report within three (3) business days; • An initial assessment and severity triage within ten (10) business days; • A remediation plan or a further status update within thirty (30) days; • Notification when the issue is resolved, where you have asked to be kept informed. These are good-faith targets, not guarantees. Complex issues may take longer, and we will tell you if they do. We may ask clarifying questions or request additional detail to reproduce the issue. We do not currently operate a paid bug-bounty program. Reports are handled on a good-faith, coordinated-disclosure basis, and we credit researchers who help us as described in Section 8.
If you conduct security research in good faith and in accordance with this policy, we consider your research authorized, and we will not initiate or support legal action against you for the research itself. "Good faith" means that you: • Act only within the scope described in Section 2; • Do not access, alter, exfiltrate, retain, or destroy data beyond the minimum required to demonstrate the issue; • Do not degrade, disrupt, or deny service to our systems or the systems of others; • Do not use the vulnerability for personal gain or to harm any person or organization; • Report the vulnerability promptly and give us a reasonable opportunity to remediate before any disclosure; and • Comply with all applicable laws. If a third party brings legal action against you for your good-faith research under this policy, we will make this authorization clear where we are able to do so. This safe harbor applies only to research under our control and does not bind third parties or authorize activity against systems we do not own or operate.
We ask that you give us a reasonable period to investigate and remediate before you disclose a vulnerability publicly. Our default coordination window is ninety (90) days from the date a report is acknowledged, or sooner if a fix is released. If you and we agree on a coordinated disclosure timeline, we will honor it. If we are unable to remediate within the window, we will explain why and agree on a revised timeline with you. We may credit you publicly as described in Section 8 when the issue is resolved.
We are grateful to the security researchers who report issues responsibly and help keep our platform and our clients' data safe. With your permission, we recognize researchers who report a valid, previously unknown vulnerability by listing your name or handle here in our public acknowledgments.
No public acknowledgments have been published yet. If you would like to be credited for a valid report, tell us in your email whether to use your name, your handle, or to remain anonymous. We will always respect your choice, including a request for no public credit.
We do not publish the details of unremediated vulnerabilities, and we may withhold or remove a credit if a report does not meet this policy or if publishing a name would create a legal or privacy concern.
This section describes security-related roles at Soflo Consulting. The machine-readable Hiring field in our security.txt file points here.
We are not currently posting dedicated security-engineering or application-security openings. When we do, we will announce them on our About page and from our Contact page.
Job applications and resumes should not be sent to security@sofloconsulting.net, that address is reserved for vulnerability reports. For general inquiries, please use our Contact page.
Report a vulnerability
Email your report with reproduction steps. We acknowledge reports within three business days. Please do not disclose details publicly until we have had a reasonable opportunity to remediate.
© 2026 Soflo Consulting, LLC. All rights reserved.
View Privacy Policy →