GCRI · Legal
Security and responsible disclosure
How to report a security vulnerability in therisk.global and its platform sites, the rules for good-faith research, the commitment not to pursue researchers who follow them, and what reporters can expect.
01Contents
Security and responsible disclosure in seven parts.
02Summary
The document in brief.
- Report vulnerabilities privately to the contact address.
- Good-faith research that follows the rules is not pursued.
- Coordinated disclosure; no reward is offered.
03Record
Version 1.0, effective 20 October 2026.
| Record | Value |
|---|---|
| Document | Security and responsible disclosure |
| Version | 1.0 |
| Effective date | 20 October 2026 |
| Last updated | 20 October 2026 |
| Publisher | The Global Centre for Risk and Innovation (GCRI Canada) |
| Contact | contact@therisk.global |
04Section 1
Scope.
- 1.1 This policy covers therisk.global and the platform sites published at addresses beginning with therisk.global/ (together, the Site), the forms and interfaces they offer and the public repositories from which they are built. Third-party services that the pages request, listed in the cookie and storage notice, are covered by their own providers' policies.
05Section 2
How to report.
- 2.1 Send a report to contact@therisk.global. Describe the vulnerability, the address or component affected, the steps to reproduce it and its likely impact.
- 2.2 Do not include exploit code, personal information, passwords or access keys in a first message. An encrypted channel is arranged on request.
06Section 3
Rules for good-faith research.
- 3.1 Access, keep or disclose no more data than is needed to show the vulnerability, and stop and report at once if personal information is reached.
- 3.2 Do not modify or delete data, degrade a Service, run denial-of-service or volumetric tests, use social engineering or phishing, attempt physical access, or test the systems of third parties.
- 3.3 Give the publisher reasonable time to fix the vulnerability before any public disclosure, and agree the date of disclosure with it. Disclosure is coordinated, and the reporter is credited if the reporter wishes.
07Section 4
Safe harbour.
- 4.1 GCRI Canada will not bring legal action against, or refer to law enforcement, a person who reports a vulnerability in good faith and follows this policy, and will treat that research as authorised for the purposes of its own terms. This commitment cannot bind third parties or authorities, and does not cover activity that breaches the law in a way this policy does not contemplate.
08Section 5
What reporters can expect.
- 5.1 An acknowledgement with a reference, an assessment of the report, updates while the fix is made and notice when it is complete. Reports are handled confidentially and the reporter's details are used only for the report.
- 5.2 No payment or reward is offered for reports.
09Section 6
Out of scope.
- 6.1 Findings of automated scanners without a demonstrated impact, the absence of a best-practice setting without a demonstrated risk, reports about third-party services, and vulnerabilities that require a compromised device or an outdated browser.
10Section 7
Incidents involving personal information.
- 7.1 An incident that affects personal information is handled, recorded and notified to the people affected and to the competent authorities as the privacy documents and the applicable law require.
11Document
Status of this document.
Prepared for review by legal counsel before adoption.
12Questions
Questions and answers.
Is there a reward for reporting a vulnerability?
No. Reporters are credited if they wish, and good-faith research that follows this policy is not pursued.
The Global Centre for Risk and Innovation
Bring a method, a dataset or a question.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.
Not for profit
Our articles, maps and twins are free to read and free to republish. Readers and partners keep it that way.
Who funds us
GCRI is a not-for-profit institution. To ask who funds a piece of work, use contact@therisk.global.
Independence
Editors and the expert reviewers named on each article decide what we publish. Funders and partners do not review or approve articles before publication.
Licence
Articles: CC BY 4.0. Figures, maps, twins and data: CC BY 4.0. Other uses: ask through contact@therisk.global.