Vulnerability Disclosure Policy
BTM Security is committed to ensuring the security and privacy of our systems and clients. We welcome reports from security researchers and the global community to identify and resolve vulnerabilities through coordinated disclosure.
Official Contact & Policy References
Within 1 business day
Triage confirmation within 72 hours
Safe Harbor Commitment
If you conduct vulnerability research in good faith and in compliance with this policy, we consider your activities authorized. BTM Security will not initiate legal action against you, nor will we request law enforcement action, provided you:
- Do not access, modify, or destroy client or user data.
- Do not degrade or disrupt the performance or availability of production services (no DoS/DDoS).
- Allow reasonable time for remediation before publishing any vulnerability details.
- Promptly cease testing and notify us immediately if you encounter sensitive data.
Verification Methods & Guidelines
To verify vulnerability reports swiftly and accurately, submissions must provide sufficient reproducible evidence. Reports may be sent to security@btmsec.com or via our TLS-secured web contact form.
Required Verification Information Checklist:
Provide the exact URL, hostname, API route, or affected parameter (e.g. https://www.btmsec.com/api/...).
Provide a non-destructive reproduction script or payload demonstrating the issue without causing harm or data leakage.
Include clear, numbered instructions that allow our engineers to reproduce the finding reliably from scratch.
Attach sample HTTP request and response headers/payloads, network traces, or sanitized screenshots.
Validation Standard: We validate reports against the Common Weakness Enumeration (CWE) and score using the Common Vulnerability Scoring System (CVSS v3.1/v4.0). Reports missing reproducible evidence cannot be validated.
Scope
*.btmsec.comdomains and subdomains- BTM Security web applications and customer portals
- Public REST and WebSocket API endpoints
- Authentication & authorization protocols
- Denial of Service (DoS/DDoS) attacks
- Spam, social engineering, or phishing against BTM staff or clients
- Physical attacks against facilities or personnel
- Automated scanner dumps without validated proof-of-concept
- Third-party cloud infrastructure (DNS providers, CDNs, hosting)
Response SLA Commitments
Receipt confirmation and ticket assignment.
Severity assessment and engineering escalation.
Regular status reports until patch deployment.
Researcher Recognition
Researchers who responsibly report validated security vulnerabilities in accordance with this policy will be eligible for public acknowledgment in our Security Hall of Fame, subject to their consent.
Submit a Vulnerability Report
Send your report directly to our security team. We respect researcher confidentiality and respond within 1 business day.