Responsible Disclosure
How to report a suspected security issue to our team.
If you believe you have found a security weakness in CostGuard, we want to hear about it. This page explains what is useful to report, how to report it safely, and what to expect afterwards. Reports reach us through the existing public Contact page.
What to report
Useful reports describe a specific weakness in the CostGuard application or its public website: a way to reach data that should not be reachable, a flaw in authentication or authorization, a way to raise privilege inside the product, or a mistake in how the site handles session or consent state. Reports about Microsoft Azure itself belong with Microsoft.
How to report safely
Send a short description, the steps needed to observe the issue, and the affected page or feature through the Contact page. Keep testing limited to your own account and your own data, stop as soon as you have shown that the issue exists, and avoid anything that degrades the service or affects other customers.
What information not to include
Do not send passwords, access tokens, API keys, certificates, connection strings, or other secrets. Do not send production customer data, exported cost data belonging to another organization, or screenshots that expose such data. Do not attach attack tooling, and do not perform destructive actions as proof.
Review and communication expectations
Reports are reviewed by the CostGuard team and answered through the same Contact route. We run no paid reward program, this page states no response or resolution time, and it offers no legal protection for testing activity. We will share what we can as the review progresses.
What this page is not
This page describes how to reach us, not a contractual commitment. It is not a reward program, not a service commitment, not a statement about monitoring coverage, and not a legal protection for testing activity. Any commitment that applies to your account comes from the agreement that applies to your account.