DRAFT — pending legal counsel review. This is a working draft prepared by the CelebIsland team. It has not been reviewed by qualified legal counsel, is not final, and may change. Items marked [COUNSEL TO CONFIRM] are open questions for counsel.
1. Purpose
This policy defines when security testing of CelebIsland, or of a Client's systems by CelebIsland, is authorised. Testing a computer system without authorisation may be a criminal offence. [COUNSEL TO CONFIRM: Cybercrimes (Prohibition, Prevention, etc.) Act 2015 (as amended) implications and safe-harbour wording.]
2. Testing CelebIsland (good-faith security research)
Researchers who find a vulnerability in CelebIsland are welcome to report it. Good-faith research is authorised when you:
- Test only against your own accounts, or accounts you have explicit permission to use.
- Do not access, modify, download or delete other users' data beyond the minimum needed to demonstrate the issue — stop and report as soon as you see someone else's data.
- Do not perform denial-of-service, spam, social engineering of staff or users, or physical attacks.
- Do not use automated scanners at a volume that degrades the service.
- Report the issue promptly and privately to security@celebisland.com [COUNSEL TO CONFIRM address] and give us reasonable time to fix it before any public disclosure. [COUNSEL TO CONFIRM: disclosure window, e.g. 90 days.]
If you follow these rules, we will not pursue legal action against you for that research and will treat your report as authorised. [COUNSEL TO CONFIRM: enforceable safe-harbour language.]
3. Out of scope
Third-party services we use (for example payment processors, cloud and streaming providers) are not covered — follow their own disclosure programmes. Reports of missing best-practice headers without a demonstrated impact are generally not treated as vulnerabilities.
4. Testing Client systems (engagements)
CelebIsland staff and contractors may test a Client system only when all of the following are in place:
- A signed authorisation from a person with authority over the systems.
- A written scope listing in-scope and out-of-scope systems, IP ranges, domains and applications.
- Agreed testing windows, permitted techniques, and any prohibited actions.
- Emergency contacts on both sides and a stop procedure.
- Agreed handling of any data encountered during testing.
5. Conduct during testing
- Stay strictly within scope. If testing reveals a path into an out-of-scope system, stop and ask.
- Stop immediately and notify the Client if testing causes instability or uncovers evidence of an active attack or illegal content.
- Keep a log of testing activity sufficient to reconstruct what was done.
6. Reporting and data
Findings are reported only to the Client's named contacts. Credentials, personal data and other sensitive information obtained during testing are stored encrypted and destroyed at the end of the engagement.
7. Training environments
Learners in Security Academy and cyber-range exercises are authorised to test only the lab environments provided for that purpose.
