Vulnerability Disclosure Policy

Hog3 is the security services brand operated by Donely, Inc. We test other organizations' defenses for a living, and we hold our own systems to the same standard. If you believe you have found a security vulnerability in a Hog3 system, we want to hear from you. This policy explains what you may test, how to report what you find, and what you can expect from us in return.

Report vulnerabilities to security@hog3.com. Our machine-readable contact details are published at https://hog3.com/.well-known/security.txt.

1. Our commitment

If you make a good-faith effort to follow this policy, we will:

• Work with you to understand and validate your report.
• Acknowledge your report and keep you informed of our progress.
• Fix confirmed vulnerabilities in a timeframe that reflects their severity.
• Credit you publicly for the discovery, if you would like to be credited.
• Not pursue or support legal action against you for research conducted under this policy.

2. Safe harbor

We consider security research conducted in good faith and in accordance with this policy to be authorized. For such research, we:

• Will not initiate or recommend legal action against you, and will not report you to law enforcement.
• Consider your research authorized under applicable anti-hacking laws, such as the Computer Fraud and Abuse Act, and will not bring a claim against you for accidental, good-faith violations of this policy.
• Waive restrictions in our Terms of Service that would otherwise interfere with research conducted under this policy, for that research only.
• Will make it known that you acted in compliance with this policy if a third party initiates legal action against you for activities conducted under it.

You remain responsible for complying with all applicable laws. If you are unsure whether a specific test is consistent with this policy, ask us at security@hog3.com before you proceed. This safe harbor covers Hog3 systems only. We cannot authorize testing of systems that belong to our clients, vendors, or any other third party.

This policy grants permission to individual researchers acting on their own behalf. It does not appoint, engage, or authorize anyone to test, scan, or contact any organization on behalf of Hog3. Hog3 performs security testing only under a written agreement with the organization being tested, and only through our own staff. If someone claims to be testing your systems, or asking for access, on Hog3's behalf without such an agreement, they are not acting for us. Please report it to security@hog3.com.

3. Scope

This policy applies to the following systems:

• hog3.com, our public website.
• Subdomains of hog3.com that Hog3 operates, such as our sign-in and client delivery services.

The following are out of scope:

• Any domain other than hog3.com and its subdomains.
• Subdomains of hog3.com operated by third-party vendors, including trust.hog3.com. Please report issues in those services to the vendor directly. You are welcome to let us know as well.
• Systems, applications, and data belonging to Hog3 clients, including anything referenced in a client report. We are authorized to test those systems; you are not.
• Third-party services we use, such as email, hosting, analytics, and payment providers.

If you are not sure whether a system is in scope, contact us before testing it.

4. Rules of engagement

When researching vulnerabilities, you must:

• Only test accounts you own, or accounts you have the explicit permission of the account holder to test.
• Access the minimum data needed to demonstrate a vulnerability. If you encounter personal data, credentials, client data, or any other sensitive information, stop, do not copy, store, or share it, and report to us immediately.
• Never access, modify, or attempt to view another client's reports, findings, or engagement data. If you find that such access is possible, that demonstration is enough. Stop and report it.
• Avoid actions that degrade or interrupt our services, destroy or modify data, or harm our users.
• Not establish persistent access, move laterally to other systems, or use an exploit beyond confirming that the vulnerability exists.
• Delete any data you obtained during your research once you have reported it, and confirm the deletion if we ask.
• Keep the details of the vulnerability confidential until we have fixed it or agreed to disclosure, as described in section 7.

The following activities are not permitted under this policy:

• Denial of service, load testing, or any testing that generates heavy or automated traffic.
• Social engineering, phishing, or impersonation of Hog3 staff, clients, or vendors.
• Physical attacks against Hog3 offices, people, or equipment.
• Spamming our forms, mailboxes, or sign-in flows.
• Testing third-party or client systems through Hog3, or using Hog3 systems as a launch point against others.
• Claiming or implying that your research is performed for, endorsed by, or on behalf of Hog3.
• Demanding payment or other compensation in exchange for not disclosing a vulnerability.

5. How to report

Send your report to security@hog3.com. A good report helps us validate and fix the issue quickly. Please include:

• The affected system or URL.
• A description of the vulnerability and its potential impact.
• Step-by-step instructions to reproduce it, including any proof-of-concept code, requests, or screenshots.
• Any accounts, data, or systems you accessed or affected during testing.
• How you would like to be credited, if at all.

Reports may be submitted anonymously. If you would like to share sensitive details through an encrypted channel, mention it in your first message and we will arrange one. We accept reports in English.

6. What to expect

After you submit a report, we aim to:

• Acknowledge receipt within 3 business days.
• Confirm whether the vulnerability is valid and in scope within 10 business days.
• Keep you informed of remediation progress at least every 30 days until the issue is resolved.
• Notify you when the vulnerability has been fixed.

We prioritize remediation by severity and real-world impact. We may contact you to ask questions or to request that you verify a fix.

7. Coordinated disclosure

We ask that you give us reasonable time to fix a vulnerability before you share any information about it publicly. Our goal is to resolve confirmed vulnerabilities and agree on disclosure within 90 days of your report. If a fix needs more time, we will explain why and agree a revised timeline with you. Please do not disclose details that would expose our clients or their data, even after a fix.

8. Recognition

Hog3 does not offer monetary rewards for vulnerability reports. With your permission, we will publicly acknowledge researchers who report valid, in-scope vulnerabilities under this policy, using the name or handle you choose.

9. Reports that are usually not accepted

The following are generally not considered vulnerabilities unless you can demonstrate a concrete security impact:

• Missing security headers, cookie flags, or best-practice configurations without a demonstrated exploit.
• Email configuration findings such as SPF, DKIM, or DMARC settings.
• Clickjacking on pages with no sensitive actions.
• Reports from automated scanners without validation.
• Software version or banner disclosure.
• Rate limiting or brute-force findings on non-sensitive endpoints.
• Self-XSS, logout CSRF, or issues that require an already compromised device or account.
• Publicly available information, such as the existence of our domains or public API keys that are intended to be public.

10. Changes to this policy

We may update this policy from time to time. The "Last updated" date shows when it was last changed. Research is governed by the version in effect when it was conducted.

11. Contact us

For vulnerability reports and questions about this policy, contact:

Donely, Inc., operating the Hog3 security services brand

Email: security@hog3.com