Vulnerability Disclosure Policy

Effective 12 October 2026

CyberSpaceRSS is a security tool, so a security problem in it matters. This Policy explains how to report one, what you can expect from us, and the legal protection we give to people who report in good faith.

1. How to report

Email security@cyberspacerss.com. Please include:

• a description of the problem and what an attacker could do with it;
• the steps needed to reproduce it, as precisely as you can, with any proof-of-concept;
• the version of the App, and whether you were using Windows, Ubuntu or the browser preview; and
• how you would like to be credited, if at all.

You may report anonymously. Do not include personal information about other people. If your report contains details that should not travel by ordinary email, say so in a first message and we will agree a safer way to receive them.

2. What you can expect from us

• We will acknowledge your report within three days.
• We will tell you whether we can reproduce the problem and what we intend to do about it, and we will keep you informed of progress.
• We will tell you when it is fixed and, if you wish, credit you by name in the release notes.
• We will not share your name or contact details with anyone else without your permission, unless the law requires it.

CyberSpaceRSS is a small, independent project and does not offer monetary rewards.

3. Scope

This Policy covers:

• the CyberSpaceRSS application for Windows and Ubuntu, including its update mechanism;
• the browser preview at app.cyberspacerss.com;
• this website, cyberspacerss.com; and
• our download and update address, downloads.cyberspacerss.com.

It does not cover systems we do not own or control. In particular, the infrastructure of our hosting and distribution providers (including Cloudflare, GitHub and the Microsoft Store) and the websites of the news publishers and agencies the Services link to are out of scope; please report problems in those to their owners. We cannot authorise testing of anyone else's systems.

The following are also out of scope: denial-of-service or load testing; social engineering, including phishing, of us or of anyone else; physical attacks; spam; findings that require a device or account that is already compromised; and reports generated by automated scanners without a demonstrated security impact.

4. Rules for research

To stay within this Policy, you must:

• act in good faith to find and report problems, and not to cause harm;
• test only on devices and data that are your own;
• not access, change, delete or keep information that belongs to other people, and stop and report at once if you come across any;
• not degrade or interrupt the Services for anyone else;
• use a problem you find only as far as is necessary to confirm it exists;
• give us a reasonable time to fix a problem before you disclose it to anyone else, which will ordinarily be up to ninety days from our acknowledgement; and
• comply with all applicable laws.

5. Safe harbour

We consider security research carried out in good faith and in accordance with this Policy to be authorised. For research that complies with this Policy:

• we will treat it as authorised access under the U.S. Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and under comparable state laws, including the computer crime provisions of the Illinois Criminal Code, and we will not bring or support a claim against you under them;
• we will not bring a claim against you under the anti-circumvention provisions of the Digital Millennium Copyright Act, 17 U.S.C. § 1201, for circumventing technology controls in the Services;
• we waive any restriction in our Terms of Use that would otherwise prohibit it; and
• if a third party brings legal action against you over it, we will make it known that your actions were carried out under this Policy.

This safe harbour applies only to claims that are ours to bring. We cannot bind any third party, and it does not cover conduct outside this Policy. If you are unsure whether something you plan to do is within it, ask us first at the address above.

6. Changes and contact

We may update this Policy; the effective date above shows when it last changed. A machine-readable summary is published at /.well-known/security.txt.

Dayshaun Thompson
security@cyberspacerss.com