======================================================================
RESPONSIBLE VULNERABILITY DISCLOSURE POLICY
======================================================================
Last Updated: October 30, 2026
42U Networks L.L.C. ("42U Networks") takes system and infrastructure
security seriously. We run production infrastructure for real customers,
which means our standard must be higher than "good enough." Even with strong
controls and automated tooling, software vulnerabilities can occasionally
occur. If you discover a security vulnerability in our systems, we appreciate
your assistance in disclosing it to us responsibly so we can investigate and
remediate it promptly.
This document sets forth our guidelines for reporting vulnerabilities, our
safe harbor commitments to security researchers, authorized testing scope,
and out-of-scope report classifications.
----------------------------------------------------------------------
1. QUICK SUMMARY
----------------------------------------------------------------------
- We welcome good-faith security reports that assist us in securing our
infrastructure and customer environments.
- We do not offer guaranteed monetary cash bounties. Where discretionary
rewards are granted, they typically consist of account or service credits,
swag, or public recognition in our Security Hall of Fame.
- We do not accept low-signal, non-exploitable submissions (such as automated
scanner output, cosmetic UI issues, or missing informational headers without
a practical exploit path).
- Do not engage in public disclosure until we have remediated the issue or
mutually agreed upon a coordinated disclosure plan.
----------------------------------------------------------------------
2. HOW TO SUBMIT A SECURITY REPORT
----------------------------------------------------------------------
Send your vulnerability report to:
Email: [email protected]
(Alternative contact: [email protected])
Subject line: "Responsible Disclosure - [Target / Summary]"
Whenever possible, please include the following technical details:
- A clear technical description of the vulnerability and its potential impact;
- Step-by-step reproduction instructions (specific hostnames, URLs, endpoints,
parameters, HTTP request/response captures, and code snippets);
- A non-destructive Proof of Concept (PoC) demonstrating practical impact
without accessing, extracting, or modifying any customer data;
- Any prerequisites or unique testing states (authentication level, role,
account type, or service tier required);
- Recommended remediation or mitigation steps (if identified).
ENCRYPTED COMMUNICATIONS:
If you prefer to submit sensitive vulnerability disclosures via encrypted
email, request our security PGP public key in your initial outreach.
----------------------------------------------------------------------
3. RULES OF ENGAGEMENT
----------------------------------------------------------------------
To ensure your research remains lawful, safe, and collaborative:
1. Act in good faith and avoid privacy-invasive testing behaviors.
2. Do not exfiltrate or download data:
- Only retrieve or observe the minimum data necessary to validate the
vulnerability.
- Do not access, download, view, export, or alter customer data.
3. Do not disrupt service operations:
- No Denial of Service (DoS/DDoS) testing, volumetric network floods, or
load testing that risks service availability.
4. Do not engage in social engineering:
- Phishing, spear-phishing, vishing, pretexting, or impersonation of
42U Networks staff, datacenter technicians, or customers is forbidden.
5. Do not establish persistence:
- No backdoors, rootkits, web shells, malware, cryptocurrency miners, or
unauthorized lateral movement between network segments.
6. Coordinated disclosure:
- Do not publish, disclose, or share technical details publicly until a fix
is deployed and verified, or a coordinated date is agreed upon in writing.
7. Consolidated reporting:
- Submit one report per underlying root cause. If multiple endpoints share
the same underlying flaw, report it as a single finding with examples.
If you are ever uncertain whether a specific testing method is permissible,
stop testing, select the least invasive approach, and notify us in your report.
----------------------------------------------------------------------
4. SAFE HARBOR (GOOD-FAITH LEGAL PROTECTION)
----------------------------------------------------------------------
If you conduct security research in compliance with this policy and operate
strictly in good faith, 42U Networks agrees that:
- We consider your research activities to be authorized under applicable
computer fraud and access statutes (including the Computer Fraud and Abuse
Act, 18 U.S.C. Section 1030);
- We will not initiate or support legal action against you for accidental,
good-faith testing conducted within the defined scope that causes no harm
to our customers, operations, or data;
- We will collaborate transparently with you to validate and remediate the
reported issue.
THIS SAFE HARBOR DOES NOT APPLY TO:
- Extortion, ransomware, threats, or demands for payments;
- Intentional degradation of services, data destruction, or intentional theft;
- Testing that violates state, federal, or international laws;
- Credential stuffing, account takeovers, or unauthorized access to customer-
owned systems or tenant environments.
----------------------------------------------------------------------
5. OUR COMMITMENTS TO RESEARCHERS
----------------------------------------------------------------------
When you report an eligible vulnerability to us:
- We will acknowledge receipt of your initial report as soon as practical;
- We will provide an initial triage assessment;
- We will keep you reasonably informed as remediation progresses;
- Upon resolution, we will credit your contribution (via our Hall of Fame
or public advisory credit) if you wish to be acknowledged.
----------------------------------------------------------------------
6. RESPONSE AND TRIAGE TIMEFRAMES
----------------------------------------------------------------------
Reports are triaged based on CVSS severity and real-world exploitability:
- Critical Severity: Acknowledgment and initial triage ASAP; target
remediation plan within 48 hours.
- High Severity: Target initial triage within 3 business days.
- Medium / Low Severity: Target initial triage within 7 business days.
Fix timelines vary depending on complexity and upstream dependencies, but
we aim to remediate most confirmed vulnerabilities within 30 days. If an
infrastructure or dependency update requires a longer window, we will provide
an updated disclosure timeline.
----------------------------------------------------------------------
7. RECOGNITION AND REWARDS
----------------------------------------------------------------------
42U Networks does not guarantee cash bounty payouts. For valid, high-impact,
in-scope vulnerability reports, we may grant discretionary rewards including:
- 42U Networks account credit or hosting service credits;
- Company swag;
- Public recognition in our Security Hall of Fame.
Reward determinations are made at our sole discretion based on technical
novelty, report quality and reproducibility, and severity of potential impact.
----------------------------------------------------------------------
8. SCOPE OF ELIGIBLE TARGETS
----------------------------------------------------------------------
IN SCOPE:
- *.42u.networks
- *.get42.us
- Customer billing portals, account dashboards, and management portals owned
and operated directly by 42U Networks;
- Core APIs operated directly by 42U Networks (including authorization and
session handling mechanisms);
- Infrastructure management endpoints explicitly operated by 42U Networks.
OUT OF SCOPE:
- Customer-owned and customer-managed applications, virtual machines, web
properties, and software hosted on our platform (these must be reported
directly to the respective customer);
- Third-party SaaS tools, payment processors (Stripe, PayPal), or external
services integrated into our workflows;
- Physical attacks against our offices, staff, or datacenter facilities;
- Social engineering, phishing, or harassment of staff or datacenter operators;
- Volumetric DoS / DDoS attacks, stress-testing, or bandwidth saturation;
- Any vulnerability requiring access to third-party data or customer accounts
you do not own.
----------------------------------------------------------------------
9. NON-QUALIFYING AND LOW-SIGNAL SUBMISSIONS
----------------------------------------------------------------------
The following submissions are non-qualifying and will be closed without action:
- Clickjacking on static pages or interfaces without state-changing actions;
- Cross-Site Request Forgery (CSRF) on unauthenticated forms (e.g., login,
logout, contact forms);
- Man-in-the-Middle (MITM) attacks requiring physical access to a user device;
- Theoretical vulnerabilities in third-party libraries without a practical PoC;
- CSV or spreadsheet injection without practical code execution;
- Standard TLS/SSL ciphersuite warnings or missing non-critical best practices;
- Content spoofing or text injection without the ability to inject HTML/CSS;
- Rate limiting or brute-force observations on non-sensitive endpoints;
- Missing HttpOnly or Secure flags on non-sensitive cookies;
- Informational DNS issues or missing email best practices (e.g., SPF, DKIM,
DMARC records) without demonstrated domain takeover or spoofing exploit;
- Issues affecting only deprecated or unpatched legacy browsers (more than two
stable releases behind);
- Descriptive error messages, stack traces, or banner version disclosures
without an accompanying vulnerability;
- Public 0-day vulnerabilities patched within the preceding 30 days;
- Tabnabbing or open redirects without demonstration of higher security impact;
- Pure automated vulnerability scanner outputs without manual validation;
- Spelling, typographic, stylistic, or minor UX/UI layout anomalies.
----------------------------------------------------------------------
10. COORDINATED DISCLOSURE GUIDELINES
----------------------------------------------------------------------
If you wish to publish an educational write-up or research blog post:
- Confirm with our security team that the patch is fully deployed in production;
- Ensure that the publication does not include exploit payloads that place
customers at risk;
- Notify us in advance of your publication handle or name for attribution.
----------------------------------------------------------------------
11. CONTACT AND SUBMISSION
----------------------------------------------------------------------
To report a vulnerability under this policy, email:
[email protected]
(or [email protected])
Subject Line: "Responsible Disclosure - [Target / Summary]"
Thank you for contributing to the security of 42U Networks and our community.
======================================================================
