Security Disclosure Policy

1. Report a concern

Send a concise report to he***@**************tt.com with “Website security report” in the subject. Identify the affected christinemoffett.com URL, what you observed, when it occurred, and the potential impact. Include minimal, redacted evidence and non-destructive reproduction details if already available. Ask for an appropriate secure channel before sharing sensitive evidence.

2. Scope and authorization

This page invites reports; it does not authorize penetration testing, exploitation, scanning at scale, access to accounts or private data, or testing of infrastructure, providers, affiliates, or client systems. Obtain express written authorization defining scope before any active security testing. Public website access alone does not confer that authorization.

3. Protect people and information

• Do not extract, modify, delete, or retain another person’s data. If you unexpectedly encounter it, stop and report the minimum facts necessary.
• Do not perform denial-of-service activity, social engineering, credential attacks, malware deployment, or attempts to establish persistence.
• Do not publish usable exploits or personal information while a report is being evaluated. Coordinate any disclosure responsibly and in accordance with law.
• Do not use ordinary email or the contact form to transmit passwords, CUI, export-controlled information, or unredacted customer records.

4. Review and communication

We will evaluate credible reports and determine an appropriate response, which may involve a service provider. Severity, available information, and third-party dependencies affect timing. This policy does not promise a specific remediation deadline, bounty, compensation, immunity, or a waiver of anyone’s legal rights. If you do not receive a response, a brief follow-up through the contact page can help identify a delivery issue.

5. Other incidents

This mailbox is not a 24-hour incident-response service. Clients should use the escalation route in their engagement or service-provider agreement. An urgent issue affecting a third-party system should be reported to that system’s authorized owner. The Privacy Policy applies to information submitted with a report.

Contact Christine Moffett LLC at he***@**************tt.com with the subject “Website security report”. Do not include passwords, controlled information, or sensitive documents in an initial message.