Responsible Disclosure

The Accountability Network, operated by the Accountability Network Foundation (Zurich, Switzerland), welcomes reports from security researchers who help us keep this website and the people who rely on it safe. If you have found a security vulnerability in expocrime.org or the infrastructure under our control, we want to hear from you.

How to report

Please email info@expocrime.org with a clear description of the issue and the steps needed to reproduce it. The more detail you provide, the faster we can confirm and fix the problem. Please give us reasonable time to investigate and remediate before disclosing the issue publicly, and coordinate any planned disclosure with us.

In scope

Security vulnerabilities affecting the expocrime.org website and the internet-facing infrastructure that we operate or control.

Out of scope — please do not

To protect the sources and whistleblowers who trust us, some activities are strictly prohibited even in the course of research. Please do not:

• attempt to access, alter or download any source, tip or correspondence data, or any other non-public data;
• exfiltrate, retain or share any data you encounter — stop and report immediately if you access non-public information;
• social-engineer, phish or otherwise target our staff, partners or sources;
• run denial-of-service (DoS/DDoS), volumetric, or automated high-traffic stress tests; or
• carry out physical attacks, or any testing that could degrade or disrupt the service for others.

Good-faith safe harbour

If you make a good-faith effort to comply with this policy during your research, we will consider your actions to be authorised, and we will not pursue or support legal action against you. We will work with you to understand and resolve the issue quickly. If at any point you are unsure whether a particular action is permitted, stop and ask us first at info@expocrime.org.

We are a nonprofit and are not able to offer monetary rewards, but we are grateful for responsible reports and the protection they give our sources.

← Back to home