Security & Responsible Disclosure
If you find a security problem in chsps.org or My CHSPS, we want to hear about it — directly, first, and without fear.
How to report
Report suspected vulnerabilities through Contact CHSPS with the subject line “Security report”. Include what you found, where (URL or endpoint), the steps to reproduce it, and how to reach you. Reports are routed to the personnel responsible for the platform and acknowledged; machine-readable coordinates are published at /.well-known/security.txt.
Scope
In scope: the public website (chsps.org), the My CHSPS portal, the public verification service and the document intake pipeline. Out of scope: volumetric denial-of-service, social engineering of CHSPS personnel or accredited organizations, physical attacks, and third-party services CHSPS does not operate (for example the payment processor's own infrastructure — card data is handled by the processor and never touches CHSPS systems).
Our commitment
CHSPS will not pursue or support legal action against good-faith security research that respects three lines: do not access, alter or exfiltrate data belonging to others (use your own test account); do not degrade the service for real users; and give CHSPS a reasonable opportunity to remediate before any public disclosure. CHSPS does not operate a paid bounty program; serious reports are credited if the reporter wishes.
What happens to a report
Reports are triaged for severity and exploitability, fixed under the platform's release controls (every release passes an integrity gate before deployment), and material incidents affecting customer data are handled and communicated per the Privacy Policy. Evidence documents uploaded to My CHSPS pass allow-listed type checks, content-signature validation and a security review before they become usable — details in the portal guide.