Skip to main content

SYNC Vulnerability Disclosure Guidelines

In SYNC we value the security research community and welcome good-faith reports of security vulnerabilities. If you’ve discovered a security issue affecting SYNC, we encourage you to report it, and we’ll work with you to resolve it promptly.

Our program follows industry standards: Coordinated Vulnerability Disclosure, Safe Harbor, Open Scope, and Core Ineligible Findings. Researchers acting in good faith and within these guidelines will not face legal action from us.

In Scope

Any asset owned and operated by SYNC under the sync.ngo domain, including our platform, web application, and API.

Focus Areas

We’re particularly interested in reports demonstrating:

  • Authentication and session management failures
  • Cross-account access and privilege escalation
  • Session hijacking and authentication bypass
  • Broken access control (including IDOR)
  • Injection vulnerabilities (SQL, command, etc.)
  • Server-Side Request Forgery (SSRF)
  • Accessing files or data without proper authorization

Out of Scope

Assets:

  • Real candidate data (CVs, personal information) — use only designated test accounts. Do not access, download, modify, or delete real user data.
  • Client or employer environments connected to our platform.
  • Third-party shared hosting we do not own or operate (including any open ports or services on shared infrastructure).
  • Domains CNAME’d to third-party services — report these to the respective service’s program.
  • Third-party SaaS we rely on — report to the respective vendor, not to us.

Activities:

  • Rate limiting issues or bypasses
  • Email bombing/flooding
  • Brute force, password spraying, or credential stuffing
  • Social engineering, phishing, or physical attacks against facilities or personnel
  • Clickjacking without demonstrable impact
  • Modifying data in accounts not owned by you
  • Downloading data beyond the minimum necessary to demonstrate a vulnerability
  • Making changes to system configurations, files, or data
  • Introducing backdoors or persistent access mechanisms
  • Interacting with end users without authorization

Informational Findings (not eligible):

  • Missing HTTP headers (HSTS, CSP, etc.) without proof of exploitability
  • SSL/TLS cipher configurations without proof of concept
  • Server version disclosure
  • Generic error messages without proof of exploitation
  • Vulnerabilities only affecting outdated browsers or plugins
  • Self-XSS requiring significant user interaction
  • SPF, DMARC, DKIM issues without demonstrable impact

    AI and Prompt Injection
  • Our platform uses AI to process candidate content (e.g. CVs). We treat prompt injection based on its actual security impact:
  • In scope: Prompt injection that leads to a concrete security impact — such as disclosure of data the attacker should not see, cross-account or privilege-boundary violations, unauthorized actions, or resource exhaustion. You must demonstrate the resulting harm, not just that the model followed injected instructions.
  • Out of scope: Prompt injection with no security impact — for example, merely causing the model to follow an injected instruction, produce off-topic output, or “obey” injected text, without any resulting data exposure, boundary violation, or damage.

    Third-Party and N-Day Policy
  • N-Day vulnerabilities: When an N-Day vulnerability is publicly disclosed, we consider it in scope 14 days after disclosure (e.g. an N-Day released January 1 becomes in-scope January 15).
  • Third-party 0-Day: We accept zero-day issues in third-party software that can directly compromise our systems, provided you allow us to coordinate disclosure with the relevant vendor.
  • Leaked credentials: If you discover leaked credentials or exposed data on dark web forums or credential dumps, you may report it to us — but do not use leaked credentials in your testing.
  • AI model providers: Vulnerabilities in upstream model providers (OpenAI, Anthropic, etc.) are out of scope — report these to the provider directly.
  • Third-party integrations: Issues that are the responsibility of a third-party integration are out of scope for this program.

Rules of Engagement

  • Use test accounts only. Never interact with real user data.
  • Stop at proof of concept — demonstrate the issue without exploiting it further.
  • For denial-of-service issues, provide a proof of concept only. Do not flood, overload, or degrade the platform.
  • Report findings promptly and privately through the form below.
  • Do not publicly disclose any finding before we have resolved it and agreed on disclosure timing.
    If you access sensitive data: If you inadvertently encounter real user data during testing, stop immediately, do not save or copy it, notify us right away, and delete any local copies. Continued access after discovering it is real data is not authorized.

Prohibited Actions

  • Denial-of-service or stress testing that impacts availability (PoC only, as above).
  • Social engineering of our staff, users, or contractors.
  • Spam, phishing, or physical attacks against our people or facilities.
  • Aggressive or high-volume automated scanning that degrades service.
  • Accessing, altering, or exfiltrating data that does not belong to you.

    Contact and Program Information
  • To report a vulnerability, please use the submission form below (anonymous submissions accepted). You may also reach us at security@sync.ngo. Our full disclosure details are published at https://sync.ngo/.well-known/security.txt
  • This is a Vulnerability Disclosure Program, not a bug bounty. We do not offer monetary rewards for reports. We deeply appreciate the community’s contributions to keeping our platform and users safe.
  • Well-written reports in English are processed fastest, though we also accept reports in Arabic.

    Recognition
  • As a thank-you, we’re happy to publicly acknowledge researchers who report valid vulnerabilities, with your permission. Let us know in your report if you’d like to be credited and how you’d like your name to appear.

To report a vulnerability, please use the form below. You may submit anonymously. The more detail you provide, the faster our team can validate and address the issue. Thank you for helping us maintain a secure platform for all our users. Your efforts are invaluable in keeping our community safe.