Purpose
The Security and Vulnerability Disclosure Policy of NextGen Privacy establishes our framework for maintaining the technical integrity, confidentiality, and resilience of our digital publishing and research platform. As an organization dedicated to data protection, cybersecurity, and youth privacy, the security of our infrastructure, readers, and confidential sources is paramount.
We recognize the vital role that independent security researchers, ethical hackers, and academic computer scientists play in identifying software vulnerabilities. This policy provides a safe harbor and clear guidelines for good-faith security research and coordinated vulnerability disclosure.
Security Contact
Security researchers may contact our Information Security Team directly via security@nextgenprivacy.org. For transmitting sensitive vulnerability details or proof-of-concept exploits, researchers must use our official PGP encryption key (fingerprint published in our security.txt file).
Urgent Reports
For urgent, critical vulnerabilities (such as active remote code execution, unauthenticated database exposure, or active source data compromise), please include ‘URGENT SECURITY VULNERABILITY’ in the email subject line for expedited emergency triage.
Scope
This policy applies exclusively to digital assets owned and operated by NextGen Privacy, specifically: The primary web domain: https://nextgenprivacy.org/ and all direct subdomains; Our web servers, APIs, and content delivery infrastructure; and Official email gateway servers.
Third-Party Services
Third-party hosted services (such as external payment processing gateways, DNS providers, or newsletter distribution systems) are excluded from testing scope. Vulnerabilities discovered in third-party services should be reported directly to the respective vendor.
Good-Faith Research
We consider security research to be conducted in good faith when researchers: Promptly report discovered vulnerabilities to us; Avoid privacy violations, destruction of data, and service disruption; Keep vulnerability details confidential until coordinated public disclosure; and Comply with the rules set forth in this policy.
Authorized Research
When security research is conducted in full compliance with this policy, NextGen Privacy considers the research to be authorized under computer crime statutes and the safe-harbor provisions of applicable law.
Safe-Harbor Approach
NextGen Privacy will not initiate legal action, civil lawsuits, or criminal complaints against security researchers for accidental or good-faith violations of law occurring during authorized testing conducted in compliance with this policy.
If legal action is initiated by a third party against a researcher for research conducted in compliance with our policy, we will make our authorization known publicly.
Prohibited Testing
Researchers must strictly avoid activities that could disrupt services or compromise data. Prohibited activities include: Denial of Service (DoS/DDoS) attacks; Physical attacks against offices or personnel; Social engineering, phishing, or pretexting attacks against employees; Automated high-volume brute-force scanning that degrades server performance; and Modifying, deleting, or retaining unauthorized user data.
Personal Information
If you encounter personal data or student records during research, stop testing immediately, do not view, copy, or retain the data, and report the vulnerability to us at once. Retaining or disseminating third-party personal data violates privacy laws and voids safe harbor.
Confidential Sources and Editorial Material
Confidential source communications, whistleblower submissions, and draft investigative dossiers are sacrosanct. Researchers who inadvertently gain access to editorial drafts must stop, maintain absolute secrecy, and alert us immediately.
Credentials and Secrets
Do not compromise administrator credentials or attempt to access other users’ accounts.
Automated Scanning
High-volume automated vulnerability scanners (such as Nessus, Burp Suite active scans, or sqlmap) must be rate-limited to avoid degrading website performance for readers.
Credential Testing and Accounts
Testing of authentication mechanisms must be conducted solely against accounts created by the researcher for testing purposes.
Uploaded Files
Do not upload malicious files, web shells, or persistent malware onto our production servers.
Cross-Site Scripting and Injection
Demonstrate XSS or injection vulnerabilities using benign proof-of-concept payloads (e.g., alert(1) or harmless console logs). Do not execute intrusive payloads.
Server-Side Request Forgery and File Access
Demonstrate SSRF or local file inclusion by reading non-sensitive system files (e.g., /etc/hostname). Do not access sensitive configuration files or cloud metadata services.
Authentication and Authorization
Demonstrate authorization bypass (IDOR) using accounts you control.
Payment and Financial Systems
Do not perform fraudulent financial transactions or manipulate payment gateways.
Published Content Risks
Do not alter or deface live published journalism on the website.
Out-of-Scope Findings
The following findings are generally considered out of scope unless they demonstrate demonstrable security impact: Missing HTTP security headers (unless leading to exploitable vulnerabilities); SPF/DKIM/DMARC informational records; Clickjacking on pages with no sensitive actions; and Non-sensitive SSL/TLS cipher suite recommendations.
Report Contents
To help us triage and remediate vulnerabilities swiftly, reports should include: A detailed description of the vulnerability and potential impact; The specific URL or component affected; Step-by-step reproduction instructions; and A benign proof-of-concept script, request capture, or screenshot.
Encryption
All vulnerability reports containing actionable exploit details must be encrypted using our published PGP key.
Acknowledgement and Triage
Our security team will acknowledge receipt of your vulnerability report within 48 hours, validate the findings, and assign a severity rating based on CVSS v3 standards.
Communication and Remediation
We will keep you informed of remediation progress and notify you when the vulnerability has been patched.
Coordinated Disclosure
We adhere to coordinated vulnerability disclosure principles. We request that researchers allow us a reasonable remediation window (typically 60 to 90 days) before publishing any public technical advisories or blog posts.
Recognition and No Bounty Promise
NextGen Privacy does not currently operate a paid cash bug bounty program. However, researchers who submit verified, high-impact vulnerabilities in good faith will be publicly acknowledged on our Security Hall of Fame (unless they prefer anonymity).
Incidents and Personal-Data Breaches
If a reported vulnerability resulted in unauthorized personal data access, our DPO initiates our formal personal data breach response procedure in compliance with statutory breach notification laws.
Confidentiality and Retention
Vulnerability reports and researcher communications are stored securely and retained for security audit records.
No Retaliation and Policy Violations
We enforce an absolute safe harbor for researchers operating within this policy. Violating these rules (e.g., demanding extortion payments or leaking source data) will result in immediate loss of safe harbor and referral to law enforcement.
Security.txt
In accordance with RFC 9116, our machine-readable security contact parameters and PGP key are published at https://nextgenprivacy.org/.well-known/security.txt.
Contact
For all security disclosures, PGP communications, or infrastructure inquiries, reach out to:
Information Security Team: security@nextgenprivacy.org
Data Protection Officer: privacy@nextgenprivacy.org
Institutional Inquiries: contact@nextgenprivacy.org