Vulnerability Disclosure Policy, Version 2026.10

AccuSights, Inc. and AccuSights LLC

1. Introduction

AccuSights, Inc. and AccuSights LLC (together, "AccuSights," "we") build and run security and compliance services, so the security of our own systems matters to us and to our customers. We welcome reports from security researchers, customers, partners and members of the public who find vulnerabilities in our systems, and we commit to working with you to understand and fix them quickly.

This Policy is based on the Cybersecurity and Infrastructure Security Agency (CISA) Vulnerability Disclosure Policy template. It tells you what systems and research are covered, how to send us a report, what you can expect from us, and what we ask of you.

2. Authorization and safe harbor

If you make a good-faith effort to comply with this Policy during your security research, we will consider your research authorized. We will work with you to understand and resolve the issue quickly, and AccuSights will not recommend or pursue legal action against you for research conducted in accordance with this Policy. Specifically:

We consider research that follows this Policy to be authorized access under the Computer Fraud and Abuse Act (18 U.S.C. § 1030), the Illinois Computer Crime Prevention Law (720 ILCS 5/17-51) and similar state laws, and exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (17 U.S.C. § 1201).
We waive any restriction in our Terms of Service, Acceptable Use Policy or Protect Services Agreement that would otherwise prohibit the research, to the extent the research complies with this Policy.
If a third party (for example, a hosting provider or a customer whose data you encountered) initiates legal action against you for activity that complied with this Policy, we will make it known that your actions were conducted in compliance with this Policy.

This safe harbor does not extend to conduct outside this Policy, and it is not a promise regarding the actions of third parties or law-enforcement agencies. If at any time you are unsure whether your research is consistent with this Policy, stop and email [email protected] (subject "ATTN: Security") before continuing.

3. Guidelines

Under this Policy, "research" means activities in which you:

Notify us as soon as possible after you discover a real or potential security issue.
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
Use exploits only to the extent necessary to confirm a vulnerability's presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command-line access, or pivot to other systems.
Stop testing and notify us immediately if you encounter any personal information, Customer Data, protected health information, or Controlled Unclassified Information. Do not view, download, copy, alter or share it beyond what is strictly needed to demonstrate the issue, and delete any copies once you have reported it.
Provide us a reasonable amount of time to resolve the issue before you disclose it publicly (Section 8).
Test only in-scope systems (Section 4) and respect systems and activities that are out of scope (Section 5).
Do not submit a high volume of low-quality reports, and do not use automated scanners at a rate that could affect availability (no more than 5 requests per second).
Do not engage in social engineering (phishing, vishing, pretexting) against AccuSights personnel, customers or partners, and do not test physical security.
Do not perform denial-of-service testing of any kind.
Do not attempt to access another customer's tenant beyond the minimum needed to demonstrate a cross-tenant issue; use your own test accounts wherever possible and mark them with "vdp-test" in the organization name.

4. Scope

The following systems and services are in scope:

accusights.com and all subdomains, including portal.accusights.com and the Empower Partner Portal
accusights.ae and subdomains (operated by AccuSights Technology Consultants LLC, dba AccuSights UAE; reports are handled through the same process)
The AccuSights Platform web application and its APIs
AccuSights-authored collectors, integrations and configuration used in AccuSights Protect (the Wazuh agent itself is third-party software — report issues in it to the Wazuh project)
Any AccuSights-authored browser extension or mobile application we publish

If you are not sure whether a system is in scope, ask us at [email protected] (subject "ATTN: Security") before testing. Any service not listed above, including connected services and any system hosted by a third party, is excluded unless we confirm otherwise in writing.

5. Out of scope

The following are not in scope and must not be tested:

Systems and infrastructure belonging to our cloud, CRM, payment or AI providers (Microsoft Azure, Amazon Web Services, Google, GoHighLevel, Stripe, OpenAI, Anthropic, Wazuh, DocuSign and others). Report issues in those services to the provider under its own program.
Customer or partner environments, endpoints, networks and cloud accounts that AccuSights assesses or monitors. These belong to our customers, and testing them without the customer's authorization is unlawful.
Third-party websites we link to, and marketing platforms (LinkedIn, Meta, YouTube).
Physical premises at 2058 N. Western Ave, Chicago, or any other office.
Findings we consider informational or low-value, including: missing security headers without a demonstrated exploit; clickjacking on pages with no sensitive actions; missing DNS records (SPF/DMARC on non-mail domains); TLS configuration reports without a working attack; software version disclosure alone; rate-limiting on non-authentication endpoints; self-XSS; CSRF on logout; results of automated scanners without proof of impact; "best practice" recommendations; and reports about outdated browsers or plugins.

6. How to report a vulnerability

Email [email protected] with the subject line "ATTN: Security". If you want to encrypt your report, use the PGP key published at accusights.com/.well-known/security.txt.

Reports may be submitted anonymously. If you share contact information, we will use it only to communicate with you about the report and, with your permission, to credit you.

A useful report includes:

the URL, hostname, application or component affected;
the type of vulnerability and a brief description of its impact;
step-by-step instructions to reproduce it, with requests/responses, screenshots or a proof-of-concept (avoid including real personal data);
the date and time you discovered it and the IP address(es) you tested from; and
any suggested remediation.

By submitting a report you agree that we may use it to improve our systems, and you grant AccuSights a perpetual, royalty-free license to any content in the report for that purpose. Please do not include anything you regard as confidential to you or a third party.

Our security.txt file at https://accusights.com/.well-known/security.txt contains the current contact, key, policy link and preferred languages (English).

7. What you can expect from us

When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible:

Acknowledgment within 3 business days that we received your report.
Initial assessment within 10 business days, telling you whether we consider the issue valid and its preliminary severity (we use CVSS v4.0 as a guide).
Ongoing updates at least every 30 days until the issue is resolved, and an opportunity to confirm the fix.
Target remediation timelines: Critical — 7 days; High — 30 days; Medium — 90 days; Low — next scheduled release. Complex issues may take longer, and we will tell you if so.
We will treat your report and identity as confidential unless you agree otherwise.
We will not take legal action against you for research that complies with this Policy (Section 2).

8. Coordinated disclosure

We ask that you give us 90 days from the date of your report before disclosing details publicly, so that we can remediate and notify affected customers. If we fix the issue sooner and confirm it to you, you may publish after the fix is deployed. If we need more than 90 days for a complex issue, we will ask you for an extension and explain why. We ask that any public disclosure omit customer data, working exploit code against unpatched systems, and information that could identify affected customers. We are happy to review a draft before publication.

Where a vulnerability affects a third-party component, we may coordinate with that vendor and with CISA or a CVE Numbering Authority, and timelines may be adjusted to align with the vendor's release.

9. Recognition

AccuSights does not currently operate a bug bounty and does not pay for vulnerability reports. This is a recognition-only program. With your permission, we will credit you by name or handle on our Security Acknowledgments page at accusights.com/legal/security-acknowledgments for the first valid report of a Medium or higher issue, and we will provide a letter confirming your contribution on request. We may, at our discretion, send AccuSights merchandise or a token of thanks, but nothing in this Policy creates an obligation to do so.

10. Questions

Questions about this Policy, or requests to confirm whether specific research is authorized, go to [email protected] (subject "ATTN: Security"). Suggestions for improving the Policy are welcome. Legal notices: [email protected] (subject "ATTN: Legal Notice"). AccuSights, Inc. and AccuSights LLC, 2058 N. Western Ave, Chicago, IL 60647.

AccuSights Vulnerability Disclosure Policy