Security Policy

1. Reporting a Vulnerability

If you believe you have discovered a security vulnerability in SGP Directory, report it to itadmin@sgpdirectory.com. Include a clear description, affected URL or component, reproduction steps, potential impact, and any proof-of-concept material.

2. Scope

This policy applies to security issues in SGP Directory services under the sgpdirectory.com domain, including public web pages, APIs, and associated console functionality.

3. Safe Testing Guidelines

When testing, please:

• Avoid denial-of-service attacks, service disruption, or excessive automation.
• Do not access, modify, or exfiltrate data that does not belong to you.
• Stop testing immediately once you confirm a vulnerability and report it promptly.
• Do not use social engineering, phishing, or physical attacks.

4. Out of Scope

• Spam, clickjacking, or missing email best-practice records without impact.
• Self-XSS and issues requiring unrealistic user interaction.
• Reports based on outdated browsers, libraries, or unsupported environments.
• Rate-limit findings without a demonstrated bypass or security impact.

5. Disclosure and Response

We aim to acknowledge valid reports within 3 business days and provide status updates as triage progresses. Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to investigate and remediate.

6. Legal Safe Harbor

We will not pursue legal action against good-faith security research conducted in accordance with this policy. Activities that violate law, privacy, or service integrity are not covered by this safe harbor.