# Dengage Vulnerability Disclosure Policy

Dengage is committed to maintaining the security and privacy of its customers, users, systems, and data. We welcome responsible reports from security researchers who identify potential vulnerabilities in Dengage systems, applications, or services.

This policy explains how security vulnerabilities should be reported to Dengage and the rules researchers must follow when performing security research.

## Reporting a Vulnerability

If you believe you have discovered a security vulnerability affecting Dengage, please report it to:

security@dengage.com

Please include as much detail as possible, including:

- A clear description of the vulnerability
- Affected domain, application, endpoint, or service
- Steps to reproduce the issue
- Potential impact
- Screenshots, logs, or proof-of-concept details, if available
- Your contact information
- Whether you would like to be publicly acknowledged

## Scope

The following assets are generally considered in scope:

- dengage.com
- app.dengage.com
- panel.dengage.com
- api.dengage.com
- trust.dengage.com
- Other Dengage-owned public web applications, APIs, and services

Systems, domains, or services not owned or operated by Dengage are out of scope unless explicitly authorized by Dengage.

## Rules of Engagement

When conducting security research, you must:

- Act in good faith and avoid harm to Dengage, its customers, and users.
- Use only your own accounts or test accounts where possible.
- Avoid accessing, modifying, deleting, exfiltrating, or disclosing customer, personal, or confidential data.
- Avoid actions that may disrupt, degrade, or damage Dengage services.
- Stop testing immediately and notify Dengage if you encounter sensitive data.
- Keep vulnerability details confidential until Dengage has investigated and addressed the issue.
- Comply with applicable laws and regulations.

## Prohibited Activities

The following activities are not permitted:

- Denial-of-service or resource exhaustion testing
- Social engineering, phishing, spam, or physical attacks
- Malware deployment
- Unauthorized access to customer or employee accounts
- Data exfiltration or disclosure
- Destructive testing
- Attacks against third-party services or infrastructure
- Automated scanning that may affect service availability

## Out-of-Scope Findings

The following findings are generally not considered reportable unless they demonstrate a clear security impact:

- Missing security headers without exploitable impact
- SPF, DKIM, or DMARC configuration observations without demonstrated abuse
- Clickjacking on pages without sensitive actions
- Rate-limiting observations without practical abuse scenario
- Self-XSS
- Vulnerabilities requiring physical access to a user device
- Issues in outdated browsers or unsupported platforms
- Publicly available information or metadata
- Best-practice recommendations without a concrete vulnerability

## Our Commitment

Dengage will review submitted vulnerability reports in good faith. Where appropriate, we aim to:

- Acknowledge receipt of the report within a reasonable timeframe
- Investigate and validate the reported issue
- Take appropriate remediation or risk treatment actions
- Keep the researcher informed where possible
- Provide public acknowledgment if the report is valid and the researcher agrees

## Safe Harbor

Dengage will not pursue legal action against researchers who conduct security research in good faith and comply with this policy.

This safe harbor does not apply to activities that involve data theft, extortion, privacy violations, service disruption, social engineering, physical attacks, or actions that violate applicable laws.

## Rewards

Dengage does not currently operate a paid bug bounty program. Submission of a vulnerability report does not create any entitlement to monetary compensation.

## Public Acknowledgment

Researchers who responsibly report valid vulnerabilities may be listed on our Security Acknowledgments page, subject to Dengage’s review and the researcher’s consent.

Security Acknowledgments:

https://dengage.com/security/acknowledgments.txt

## Contact

For vulnerability reports and security-related communications:

security@dengage.com