Report a security issue

1. Scope

This responsible-disclosure policy covers:

• The NCCC Convene web portal (this domain) and any sub-domain operated by the NCCC for individual events.
• The backend APIs used by the portal (administration, accreditation, broadcasts, file storage).
• The PDF badge generator and QR signing infrastructure.

Out of scope:

• Other systems operated by the Office of the National Security Adviser, the NCCC, or partner agencies.
• Third-party services we depend on (Microsoft 365 SMTP, Kudisms SMS gateway) — please report to those providers directly.
• Social engineering of NCCC staff, denial-of-service, and physical attacks on accreditation desks.

2. How to report

Email security@nccc.gov.ng with as much detail as possible:

• A clear description of the vulnerability and the affected URL or component.
• Steps to reproduce, including any HTTP requests, payloads, or screenshots.
• Your assessment of the impact (data disclosure, account takeover, privilege escalation, etc.).
• Whether you’ve disclosed this to anyone else, including the date.
• How you’d like to be credited (or whether you prefer to remain anonymous).

If your finding includes sensitive information (working exploit, captured data) please encrypt with our PGP key on request.

3. Our commitment to you

• Acknowledgement within 2 working days of receipt.
• Triage status within 7 working days — accepted, needs more info, or out of scope.
• Resolution timeline shared once we’ve scoped the fix.
• No legal action against you for good-faith research that follows this policy.
• Public credit in our security advisories, if you want it.

4. Rules of engagement

To stay within "good faith" research:

• Do not access, modify, or exfiltrate data that isn’t yours. If you accidentally do, tell us immediately and stop.
• Do not run automated scanners that generate high traffic.
• Do not perform denial-of-service or social-engineering attacks on staff.
• Do not attempt to access the physical accreditation hardware on event days.
• Do not publish or share the vulnerability before we’ve had a reasonable chance to fix it (typically 90 days).

5. Safe-harbour

Research conducted under this policy is considered authorised activity. We will not pursue civil or criminal action against you, and we will work with any law-enforcement enquiry to advocate on your behalf, provided you’ve acted in good faith and within the rules above.

6. Out of scope vulnerability classes

The following are not eligible for credit unless paired with a clear impact:

• Missing security headers without a demonstrable exploit.
• Self-XSS that requires the victim to paste a payload.
• Login/registration enumeration via timing.
• Click-jacking on pages without sensitive actions.
• Outdated software versions without a working PoC.
• Issues in third-party dependencies that are not exploitable in our deployment.

7. Contact

Email: security@nccc.gov.ng
General support: appsupport@nccc.gov.ng