News
cybersecurity NGINX Heap Overflow Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - CyberPress threat-intel OpenAI Open-Sources Codex Security CLI to Find, Validate, and Fix Code Vulnerabilities - GBHackers threat-intel Autonomous AI Agent Escapes Sandbox and Breaches Hugging Face Production Systems - GBHackers ai Anthropic says Claude uncovers cryptographic weaknesses, advances AI-assisted security research - The Economic Times - Anthropic - Claude AI cybersecurity Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js - The Hacker News threat-intel Claude AI Autonomously Discovers Cryptographic Weaknesses That Escaped Expert Review - GBHackers threat-intel NGINX Heap Overflow Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code - GBHackers vulnerability Coordinated “cyberattack” on Minnesota water utilities: What you need to know - Tenable Security Research ai Anthropic's Claude Mythos Finds Encryption Flaw Following OpenAI Agents' Containment Breach - International Business Times - Anthropic - Claude AI cybersecurity OpenAI’s Rogue AI Agent Hacked More Than Just Hugging Face - Wired Security cybersecurity A Typo Landed an Innocent Gamer in Prison for 18 Months - Wired Security ai How to keep your Claude chats and Google files private - The Guardian - Anthropic - Claude AI cybersecurity We now have a better understanding how OpenAI hacked into Hugging Face - Ars Technica Security cybersecurity Ghost Credentials Expose Cloud Systems to Hidden Identity Risks - Dark Reading cybersecurity CubePilot drone software dev hit by DNS hijacking to intercept traffic - BleepingComputer
1 / 15
All news ›

Responsible Disclosure Policy

Pro CISO® B.V. — Security Vulnerability Reporting

Report a vulnerability: security@prociso.com
We will acknowledge your report within 2 business days and keep you informed throughout.

Our Commitment

Pro CISO® B.V. takes the security of our systems and customer data seriously. We are ISO/IEC 27001:2022 certified and operate a formal Information Security Management System. Despite our best efforts, vulnerabilities may exist. We welcome responsible disclosure from the security community and commit to working with you transparently and in good faith.

Scope

This policy applies to vulnerabilities discovered in:

  • Our website: prociso.com and subdomains
  • The CA/CR® platform: cacr.prociso.com
  • Any other internet-facing systems operated by Pro CISO® B.V.

This policy does not cover vulnerabilities in third-party services or products we use but do not operate (e.g. Microsoft 365, cloud infrastructure providers).

What We Ask of You

  • Report the vulnerability to us promptly and in good faith at security@prociso.com
  • Give us reasonable time to investigate and remediate before public disclosure (we ask for a minimum of 90 days)
  • Do not access, modify, or delete data belonging to others
  • Do not perform denial-of-service attacks, social engineering, or physical security testing
  • Do not disclose the vulnerability to third parties before we have resolved it

What to Include in Your Report

  • A clear description of the vulnerability and the potential impact
  • The URL, system, or component affected
  • Step-by-step reproduction instructions
  • Any proof-of-concept code or screenshots (where relevant)
  • Your contact details so we can follow up

What We Commit to You

  • Acknowledge receipt of your report within 2 business days
  • Provide a preliminary assessment within 5 business days
  • Keep you informed of progress throughout remediation
  • Not pursue legal action against researchers who act in good faith and within this policy
  • Credit you publicly for the discovery (if you wish)

Out of Scope

The following are explicitly out of scope and should not be tested:

  • Denial-of-service or volumetric attacks of any kind
  • Automated scanning without prior permission
  • Physical security testing
  • Social engineering of Pro CISO® staff or customers
  • Vulnerabilities requiring physical access to a user's device
  • Self-XSS or issues only exploitable by an authenticated admin

Contact

Send all vulnerability reports to:

Pro CISO® B.V. - Security Team
security@prociso.com

For encrypted communication, please request our PGP key in your initial email and we will provide it promptly.