Vulnerability Disclosure Policy

1.Purpose

1.1 McCray Global Protection Corp. ("McCray") welcomes reports of suspected security vulnerabilities in the website at mccraygp.com (the "Website"). This Policy explains how to report a vulnerability and what McCray asks of anyone who does.

2.How to Report

2.1 Reports should be sent to the security contact listed in the Website's security.txt file at mccraygp.com/.well-known/security.txt.

2.2 A report should describe the issue, the page or feature affected, the steps needed to reproduce it, and how the reporter can be contacted.

3.Guidelines for Reporters

3.1 Section 5.3 of the Website Terms and Conditions prohibits probing, scanning or testing the Website. This Policy does not authorize testing. It provides a channel for reporting issues that a person has come across.

3.2 Reporters are asked to:

• not access, change or delete data that does not belong to them;
• not disrupt the Website or degrade its performance;
• not use social engineering, physical intrusion or attacks on McCray personnel, clients or vendors;
• not publicly disclose the issue until McCray has had a reasonable time to address it; and
• comply with all applicable laws.

4.What McCray Will Do

4.1 McCray will make reasonable efforts to acknowledge reports, review them and address confirmed issues. McCray may contact the reporter for more information.

4.2 McCray does not offer payment or rewards for reports.

5.Out of Scope

5.1 This Policy covers the Website only. It does not cover third-party services linked from the Website, including job platforms, social media and mapping services, which should be reported to their owners.

5.2 This Policy does not cover physical security at client sites. Concerns about a site or an officer should be raised through the Contact page.

6.Nature of This Policy

6.1 This Policy is not a contract and does not create any right or authorization to test the Website. McCray may change it at any time by posting an updated version.