Loading
Official framework for ethical security researchers to discover and report vulnerabilities within the Cybersecurity Center of Excellence (CCoE) infrastructure.
CCoE is a cybersecurity organization. We hold ourselves to the same standards of responsible security practice that we teach. If you discover a security vulnerability in any CCoE-operated system, platform, or service, we want to know about it — and we are committed to responding promptly, transparently, and without retaliation.
SUBJECT LINE: Vulnerability Report — [brief description]
PGP encryption is available for sensitive reports. Contact us at security@ccoe.bd to request our public key.
Description of the vulnerability, affected system/URL, steps to reproduce, potential impact assessment, and any proof-of-concept (non-destructive only).
Acknowledgement — We will acknowledge receipt of your report within 3 business days.
Initial Assessment — We will provide an initial assessment of severity and scope within 10 business days.
Remediation — We aim to remediate critical vulnerabilities within 30 days, and all other validated vulnerabilities within 90 days.
Updates — We will keep you informed of progress throughout the remediation process.
Recognition — With your consent, we will acknowledge valid reports in our program reports or on a public security acknowledgements page.
No Retaliation — We will not pursue legal action against researchers acting in good faith under this policy.
CCoE follows a coordinated disclosure model. We request that researchers allow us a minimum of 90 days to remediate a validated vulnerability before any public disclosure. If you have concerns about our progress, please contact us before going public so we can coordinate an appropriate response.
