Brandcast Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://support.timesites.com/en/articles/990526-security-disclosure
docs: https://support.timesites.com/en/articles/990526-security-disclosure
program:
  published: true
  type: responsible-disclosure
  name: SITES (formerly Brandcast) responsible disclosure
  bug_bounty: false
  monetary_reward: false
  reward: >-
    Non-monetary. The policy offers "swag" — stickers, t-shirts and hoodies —
    for a qualifying first disclosure.
  platform: null
  note: >-
    Self-hosted policy in the provider's support centre. Not on HackerOne,
    Bugcrowd or Intigriti — those were checked and there is no Brandcast /
    Sites program listed.
contact:
  email: infosec@time.com
  url: https://support.timesites.com/en/articles/990526-security-disclosure
  encryption:
    method: pgp
    key_id: 398A5770F613C390
    algorithm: RSA
    key_size: 4096
    fingerprint: 9BB0 61DA 7548 037B 544C 9444 398A 5770 F613 C390
    user_id: SITES Security <infosec@time.com>
    note: >-
      The armoured public key block is published inline in the article. It is
      deliberately NOT mirrored into this repo — only its identifying metadata
      is recorded. Worth noting for provenance: the key's embedded User ID
      still reads "Brandcast Security <security@brandcast.com>", confirming the
      policy is the same one Brandcast published before the Sites rename.
scope:
  in_scope:
  - The main SITES website and application
  out_of_scope:
  - Vulnerabilities hosted by a third party (CDN, blog, support, analytics)
    unless they lead to a vulnerability on the main website or application
  - DoS / DDoS attacks
  - Spam
eligibility:
- You must be the first person to disclose the vulnerability.
- You must not have disclosed the vulnerability to anyone or anywhere else.
safe_harbor:
  offered: true
  text: >-
    "We won't take legal action against you, or administrative action against
    your SITES account" provided the researcher acts in good faith towards user
    privacy and data during disclosure.
security_txt:
  served: false
  note: >-
    No /.well-known/security.txt is served on any Brandcast host — see
    well-known/brandcast-well-known.yml. The disclosure policy exists but is
    reachable only as a help-centre article, so an automated scanner will not
    find it.
pentest:
  customer_testing_allowed: true
  note: >-
    "Can we perform a penetration test or security scan? Yes. We welcome any
    tests needed to ensure your comfort on the platform. We only ask that you
    arrange to do so ahead of time."
  source: https://support.timesites.com/en/articles/969034-sites-platform-faq-for-it
evidence:
- url: https://support.timesites.com/en/articles/990526-security-disclosure
  http_status: 200
  fetched: '2026-08-13'
- url: https://support.timesites.com/en/articles/966545-security-overview
  http_status: 200
  fetched: '2026-08-13'