Last updated: October 2026 (active since May 2024)

Contact: vdp@c2society.org

C2Society values the security community and welcomes reports from researchers who help us protect our members, events, and infrastructure. This policy describes what you may test, how to report, and what you can expect from us.

Scope

In scope: The following domains and all of their subdomains (*.domain) that C2Society owns and operates:

• dc702.space
• c2society.org
• c2society.com
• the-petting-zoo.com
• 0x3fcube.com
• crackthecore.com
• nullsociety.cc

Out of scope:

• Third-party platforms and vendors, including Shopify, Cloudflare, payment processors, and hosted SaaS tools. Report issues on those platforms directly to the vendor.
• CTF challenges and labs that are meant to be exploited. A report is eligible only if it escapes the challenge environment or affects the underlying infrastructure.
• Denial of service (DoS/DDoS), volumetric testing, or resource exhaustion.
• Social engineering, phishing, or physical attacks against staff, volunteers, members, or event venues.
• Low-impact findings that can't be exploited, such as missing headers with no security impact, self-XSS, clickjacking on pages with no sensitive actions, SPF/DMARC configuration on its own, version banners, or reports from automated scanners only.

Rules of Engagement

• Test only against accounts and data you own, or that you have explicit permission to use.
• Do not access, change, delete, or keep data that belongs to others. If you come across sensitive data, stop, report it right away, and do not keep copies.
• Do not degrade service availability or disrupt live events.
• Keep findings confidential until we have fixed them or agreed to a disclosure date with you.

Safe Harbor

If you make a good-faith effort to follow this policy, C2Society will:

• Consider your research authorized and not pursue or support legal action against you, including under anti-hacking laws (such as the CFAA) or anti-circumvention laws (such as the DMCA).
• Treat your activity as an authorized exception to our Terms of Service where those terms conflict with security research.
• Make it known that your research was authorized if a third party takes legal action against you over activity that complied with this policy.

Safe harbor does not cover third-party systems. If you're unsure whether something is allowed, email us before you test.

How to Report

Send your report to vdp@c2society.org. Please include:

1. Summary: the vulnerability type, mapped to the relevant OWASP Top 10 or OWASP API Security Top 10 category and a CWE ID where possible.
2. Affected asset(s): URL(s), endpoint(s), parameters.
3. Steps to reproduce: clear steps, with a proof of concept, screenshots, or request/response pairs.
4. Impact: what an attacker could achieve.
5. Severity: your estimated CVSS v4.0 score and vector, or an OWASP Risk Rating.
6. Your name or handle for credit, if you'd like to be credited.

Rewards

Rewards are decided case by case. They depend on the validated severity, the real-world impact on C2Society, and the impact on related events and communities. Rewards may be monetary, swag, event recognition, or a listing in our Hall of Fame. Only the first valid report of an issue is eligible. Submitting a report does not guarantee a reward.

If you have any questions about our program, please email us at: vdp@c2society.org.