Security

Reporting a Security Vulnerability

Summit Consulting Group, Inc. takes the security of our products and the data our customers trust us with seriously. We welcome reports from security researchers and members of the public who believe they have found a vulnerability in our systems.

This page explains how to report a vulnerability, what we ask of you, and what you can expect from us.

How to Report

Email [email protected].

Please include as much of the following as you can:

• Where. The URL, product, or system affected.
• What. A description of the vulnerability and the type of issue, such as cross-site scripting, broken access control, or information disclosure.
• How. Step-by-step instructions to reproduce it. Include any requests, payloads, screenshots, or proof-of-concept code.
• Impact. What an attacker could do by exploiting it.
• When. The date and time you found it.
• Contact. How we can reach you with questions. Tell us if you would like to be credited, and the name to use.

Please do not include real personal data, such as student records, in your report. If you encountered any, tell us that you did, but do not send it to us.

Scope

This policy covers the following domains and every subdomain of them:

• brightshiftinc.com
• summitcgi.com
• asestudentcertification.com

Anything not listed here is out of scope. This includes third-party services we use, such as our hosting, email, and payment providers. Please report issues in those services to the provider directly.

Out of Scope

The following are not eligible under this policy:

• Denial of service or load testing of any kind.
• Social engineering or phishing of our staff, customers, or students.
• Physical attacks against our offices or equipment.
• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing security headers, cookie flags, or email records such as SPF and DMARC, without a demonstrated, exploitable impact.
• Clickjacking on pages that have no sensitive actions.
• Vulnerabilities that require a compromised device or an outdated, unsupported browser.
• Rate limiting or brute force issues without a demonstrated, exploitable impact.

Rules for Testing

When researching a vulnerability, you must:

• Only test against accounts you own, or accounts whose owner has given you explicit permission.
• Stop testing as soon as you have confirmed the vulnerability.
• Not access, change, delete, download, or keep data that belongs to anyone else. If you access such data by accident, stop, and tell us in your report.
• Not degrade or interrupt our services for other users.
• Not use a vulnerability beyond what is needed to demonstrate it.
• Keep the details of the vulnerability confidential until we have fixed it, or until 90 days after your report, whichever is sooner. If we need longer, we will explain why and agree a date with you.

Our products are used by schools and students. Student education records are protected by law, and we treat any access to them with particular seriousness.

What You Can Expect From Us

When you report a vulnerability in line with this policy, we will:

• Acknowledge your report within 5 business days.
• Give you our initial assessment within 10 business days of acknowledging it.
• Keep you informed as we work on a fix.
• Tell you when the issue has been fixed.
• Credit you publicly if you would like us to, once the issue is fixed.

Safe Harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not take legal action against you or ask law enforcement to investigate you for it.

If a third party takes legal action against you for research that followed this policy, we will make it known that your research was authorized.

If you are unsure whether something you plan to do is consistent with this policy, email [email protected] and ask before you do it.

Rewards

We do not operate a bug bounty program and do not pay for vulnerability reports.

Changes to This Policy

We may update this policy from time to time. The current version is always published on this page.

Last updated: 7 October 2026