Last updated: 24 July 2026
Safe-harbour intent
Cyberross will not pursue legal action against good-faith research that follows this policy, avoids harm, and gives us reasonable time to investigate and remediate.
In scope
Security issues in public Benedam surfaces owned by Cyberross, including benedam.com, auth.benedam.com, and the public demo. Only use accounts and data you own or are explicitly authorised to test.
Out of scope
- Testing customer tenant workspaces, customer assets, or production scan targets.
- Denial of service, high-volume scanning, social engineering, or physical access.
- Accessing, changing, retaining, or publishing data that is not yours.
- Automated reports without a demonstrated security impact.
How to report
Send a concise description, affected URL, reproduction steps, impact, and any safe supporting evidence to [email protected]. Do not include secrets in ordinary email; ask for an encrypted channel when necessary.
What to expect
We will acknowledge the report, establish a secure communication path where needed, assess severity, and coordinate disclosure timing. This page does not promise an SLA until one is formally adopted and measured.