1. Program Overview & Platform Scope Commitment
DashSecurity and KPLTGROUP are committed to safeguarding user data across all decentralized services, interactive cybersecurity labs, exam verification keys, and open-source intelligence tools. We welcome ethical security researchers to audit our entire public ecosystem under coordinated disclosure rules.
2. Comprehensive Program Scope & In-Scope Systems
All authorized modules, technical targets, permitted parameters, and operational boundaries.
NGLChain decentralized protocol, node verification mechanisms, state machine management, and consensus interface.
Supabase user sessions, MFA verification logic, exam access keys, and RBAC authorization tokens.
AI SAST patch generator, SOC roleplay command engine, STRIDE solver, and code challenge sandboxes.
Open Source Vulnerability intelligence scanner, CVE lookup cache, TRC cloud, and feeds aggregator.
- NGLChain Protocol:
https://dashsecurity.kpltgroup.com/nglchain/* - Auth & Dashboard:
https://dashsecurity.kpltgroup.com/login/*,/dashboard/*,/auth/* - Key & Exam Testing Engine:
/pv_management_key/*,/pv_exam/*,/cc-exam-db/*,/cissp-exam-db/* - Security Training Labs:
/code-security-lab/*,/incident-room/*,/threat-modeling-lab/*,/spot_the_bug/* - OSV & Threat Intelligence:
/osv-intelligence/*,/trc-research-cloud/* - Client-Side APIs & Data Parsers: All JSON parsers, DOM handlers, state stores, and session validators
- Cloud & Hosting Core: Third-party infrastructure providers (Cloudflare edge, Netlify core CDN, Supabase DB internal servers)
- Denial of Service (DoS / DDoS): Any volumetric traffic flooding, stress testing, or resource exhaustion attacks
- Social Engineering & Phishing: Targeting administrators, staff, contributors, or users
- Third-Party External Services: Upstream npm registries, external OSV API servers, or Google Fonts CDN
3. Rules of Engagement & Safe Harbor Policy
Under our Safe Harbor commitment, DashSecurity and KPLTGROUP pledge not to initiate legal action against researchers who strictly adhere to the following four core rules:
No Data Destruction
Never delete, modify, or corrupt production data. Testing must not compromise the availability, performance, or integrity of live services.
Minimal Proof of Concept
Access only the minimum data necessary to prove the existence of a vulnerability (e.g., viewing 1 test record). Cease testing immediately upon confirmation.
Privacy & Data Protection
Do not download, copy, disclose, or retain any Personally Identifiable Information (PII) or confidential third-party data.
Coordinated Disclosure
Maintain strict confidentiality. Do not disclose vulnerability details publicly before patches have been deployed and mutual written consent is granted.
4. Excluded Vulnerabilities (Non-Qualifying Issues)
To eliminate noise and automated scanner spam, the following findings are ineligible for recognition unless accompanied by a verified high-impact exploit chain:
- Missing standard security headers (e.g., HSTS, CSP, X-Content-Type-Options) without a demonstrable exploit PoC
- Missing or misconfigured SPF, DKIM, or DMARC records
- Self-XSS (XSS that can only be executed by and affect the authenticated user themselves)
- Generic software version disclosures or server banner information without active exploitability
- Unmodified raw outputs from automated vulnerability scanners lacking reproducible step-by-step PoCs
5. Severity & Recognition Matrix
Vulnerability risk categorization, honor tiers, and researcher commemorations (Unpaid/Non-monetary).
| Severity Tier | Vulnerability Class & Examples | Recognition & Honors (Non-Monetary) |
|---|---|---|
|
Critical
CVSS 9.0 - 10.0
|
• Remote Code Execution (RCE)
CWE-94 / CWE-78
Arbitrary server-side command execution, code injection in backend runners, or template sandbox escapes.
• Core Authentication & Admin Bypass
CWE-287 / CWE-306
Complete authentication bypass permitting unauthenticated administrator takeover or multi-tenant compromise.
• Blockchain State Drain & Consensus Hijack
CWE-829 / CWE-840
Total asset drain in NGLChain smart contracts, consensus partitioning, double-spending, or node hijacking.
• Cryptographic Key Minting & License Forgery
CWE-347 / CWE-327
Algorithm reversal or signature forging in
pv_management_key enabling arbitrary license generation.
• Critical Database Injection (SQLi / NoSQLi)
CWE-89 / CWE-943
Injection leading to full database extraction, data destruction, or arbitrary table write access.
|
Grandmaster Hall of Fame Listing
• 1,000+ Reputation Points
• Official Digital Certificate of Appreciation • Grandmaster Verified Contributor Badge • Exclusive Feature in Release Notes |
|
High
CVSS 7.0 - 8.9
|
• Insecure Direct Object References (IDOR)
CWE-639
Unauthorized viewing or modification of other users' exam histories, private keys, or profile records.
• Stored Cross-Site Scripting (Stored XSS)
CWE-79
Persistent malicious script injection executing in dashboard views, student exam portals, or shared lab rooms.
• Server-Side Request Forgery (SSRF)
CWE-918
Targeted server requests to internal subnets, localhost services, or cloud instance metadata (169.254.169.254).
• Privilege Escalation (Role & Permission Bypass)
CWE-269 / CWE-285
Bypassing RBAC checks to elevate normal student/hunter accounts into instructor or administrative roles.
• Account Takeover via OAuth / Session Hijacking
CWE-384 / CWE-613
Flaws in OAuth state validation, token leakage, or session fixation leading to account hijacking without credentials.
|
Diamond Hall of Fame Listing
• 500+ Reputation Points
• Official Digital Certificate of Appreciation • Diamond Hunter Badge • Listed on Public Security Advisories |
|
Medium
CVSS 4.0 - 6.9
|
• Cross-Site Request Forgery (CSRF)
CWE-352
State-changing actions triggered on behalf of authenticated victims (profile modifications, key resets).
• Reflected Cross-Site Scripting (Reflected XSS)
CWE-79
Non-persistent script execution requiring targeted link clicks or search parameter reflection.
• Broken Rate Limiting on Sensitive Workflows
CWE-307 / CWE-799
Unrestricted brute-forcing of OTP codes, password resets, or exam verification tokens without throttling.
• Business Logic Flaws & Exam Score Tampering
CWE-840
Manipulating grading algorithms, skipping mandatory exam stages, or spoofing lab completion metrics.
• CORS Misconfiguration with Sensitive Leakage
CWE-942
Permissive wildcard CORS headers combined with credential support leading to authenticated data theft.
|
Verified Hunter Listing
• 100+ Reputation Points
• Official Digital Certificate of Appreciation • Verified Hunter Badge |
|
Low
CVSS 0.1 - 3.9
|
• Open Redirect to Untrusted Domains
CWE-601
Unvalidated redirection parameters enabling deceptive phishing redirects from official domains.
• Information Disclosure via Diagnostic Headers
CWE-200
Leakage of internal software build commits, non-sensitive debug traces, or internal server paths.
• Insecure Session Cookie Flags & Content Spoofing
CWE-614 / CWE-74
Missing SameSite/Secure cookie attributes on non-critical cookies, or text spoofing without script execution.
|
Hall of Fame Commendation
• 25+ Reputation Points
• Public Acknowledgment on Directory |
* Note: DashSecurity & KPLTGROUP do not provide financial compensation. All rewards are in the form of reputation, public acknowledgement, and verified certificates.
6. Vulnerability Submission Channel
Submit security findings directly to our security coordination team or use the interactive generator below.
Interactive Report Builder & Template
Fill in the structured fields below to generate a clean, standard Markdown report with 1-click database submission and email launch.
7. Hall of Fame (Security Researchers Wall)
Honoring ethical hackers and security researchers who contribute to safeguarding the DashSecurity ecosystem.
Security Researchers Hall of Fame & Directory
Visit the full Hall of Fame leaderboard to view verified security disclosures, certificate archives, and top contributing security researchers.