SHIELDMIXONE
VULNERABILITY DISCLOSURE PROGRAM (VDP)

Responsible Disclosure Policy

Safe Harbor Guidelines & Vulnerability Reporting Protocol

LEGAL REVIEW RECOMMENDED: This policy establishes safe harbor terms for defensive researchers submitting security vulnerability disclosures. External researchers and participating corporate counsel should review these guidelines prior to coordinating disclosures.
Shieldmix values the contributions of the cybersecurity research community. If you believe you have discovered a security vulnerability in our platform or infrastructure, we encourage you to report it to us responsibly. We are committed to working with security researchers to validate and resolve reported vulnerabilities promptly.

1. Safe Harbor Commitment

Shieldmix will not pursue civil action or initiate legal complaints against researchers who:

  • Act in good faith to identify vulnerabilities without causing service disruption or data loss.
  • Avoid accessing, copying, modifying, or retaining customer data or sensitive user information.
  • Promptly disclose vulnerabilities directly to Shieldmix without sharing details publicly before a fix is released.
  • Comply with our testing scope boundaries.

2. In-Scope & Out-of-Scope Assets

In Scope
  • • https://shield.vpshub.biz
  • • Shieldmix One APIs (/api/*)
  • • Mobile companion backend endpoints
Strictly Out of Scope
  • • Customer target assets being scanned
  • • Volumetric Denial of Service (DoS/DDoS)
  • • Third-party hosting / upstream VPS infrastructure
  • • Social engineering or phishing of Shieldmix staff

3. How to Submit a Vulnerability Report

Submit reports via email to security@shieldmix.com or inspect our RFC 9116 /.well-known/security.txt file at /.well-known/security.txt.

Please include:

  • Description of the vulnerability and its potential impact.
  • Step-by-step reproduction steps or minimal proof-of-concept.
  • Affected endpoint, URL, or code component.

4. Response SLA & Acknowledgement

  • Initial Acknowledgement: Within 24 business hours.
  • Triage & Severity Assessment: Within 72 business hours.
  • Remediation Timeline: Critical/High vulnerabilities prioritized for immediate patch deployment.