Security contact
Responsible security disclosure
How to report a suspected security vulnerability affecting the DSA QAI public website.
Report securely
Send a concise description, affected URL, reproduction steps and potential impact to security@dsaqai.com. Do not include personal, financial or client data in the initial report.
Research boundaries
Avoid privacy violations, data destruction, service disruption, social engineering, physical attacks, denial-of-service testing and access beyond what is necessary to demonstrate the issue.
Good-faith process
If you follow these boundaries, report promptly and give us reasonable time to investigate, we will treat the research as a good-faith effort and work to understand the finding. Any formal safe-harbour commitment is subject to applicable law and authorised review.
What to expect
We aim to acknowledge a valid report, assign an internal owner and provide updates when doing so will not increase risk. Timelines depend on severity, reproducibility and affected systems.
Recognition
Do not disclose a finding publicly until a coordinated timeline is agreed. Recognition, reward or bounty is not promised unless confirmed in writing.