Security
Vulnerability Disclosure Policy
ConnectCorr is committed to the security of the communities and institutions we serve. If you believe you have found a security vulnerability in our systems, we want to hear from you. Our disclosure process follows the Government of Canada Coordinated Vulnerability Disclosure (CVD) model: a clear channel, good-faith engagement, and coordinated, responsible resolution.
How to report
Send the details to Info@connectionsincorrections.ca, or use our toll-free line at +1 (844) 242-0444. Please include a description of the issue, the affected system or page, and steps to reproduce it.
Scope
This policy covers the ConnectCorr website and, once operational, the ConnectCorr platform and its supporting infrastructure. ConnectCorr does not operate a public bug bounty program at this time; reports are voluntary and deeply appreciated.
Safe harbour
We will not pursue legal action against security researchers who make a good-faith effort to report a vulnerability to us, avoid privacy violations and service degradation, and give us reasonable time to respond and remediate before public disclosure.
What to expect
We will acknowledge your report within 5 business days and keep you informed of remediation progress. Once an issue is resolved, we are happy to credit your contribution publicly if you wish.