Home / Help centre / Security & privacy
Security & privacy
How do I report a security issue in Cyberlop?
Report a security issue in Cyberlop to your organisation’s Cyberlop administrator or security team, as the Security page directs. Include what you saw and the steps to repeat it, and leave out real secrets. You can also reach Cyberlop through the contact page.
Steps
- Stop and note what you saw: the page, the time and what looked wrong.
- Write the steps that lead to the problem, so someone else can follow them and see it too.
- Keep secrets out of your notes. Leave out passwords, tokens and real customer data. A screenshot with the sensitive parts hidden works well.
- Send the report to your organisation’s Cyberlop administrator or security team. That is the first route the Security page names.
- If you need to reach Cyberlop directly, use /contact and say plainly that it is a security issue.
Good to know
The page asks you to "report security issues to your organization’s Cyberlop administrator or security team." It do not give a separate disclosure address, so do not guess one. Use the contact page for Cyberlop itself.
| Include | Leave out |
|---|---|
| Page or area and the time | Passwords and tokens |
| Steps to repeat it | Real customer records |
| What you expected and what happened | Anything you were not allowed to test |
Only report what you found in the course of normal, authorised use. Never probe a system you have no written permission to test. That rule protects you as well as us.
Administrators can check the Activity feed for related entries, such as sign-ins, token changes and support sessions, and they can revoke a user’s API tokens. For background, read how sessions stay secure and how credentials are stored.
The idea of structured reporting has a name, vulnerability disclosure.
Related questions
- Can Cyberlop staff see my source code?
- How are sign-in sessions secured?
- How does Cyberlop store my credentials and tokens?
- How do I see what's been happening in my workspace?
- How do I revoke a user's API tokens?
Updated · Back to the help centre
Security question we did not answer?
Our team will answer it directly, or walk through it on a call with your security lead.