Security / Responsible Disclosure

Security researcher

Security research at Ethan Consulting is carried out by:

• Name: Henrique Vidal
• Role: Security researcher, Ethan Consulting
• Patchstack profile: View the Patchstack profile
• LinkedIn: linkedin.com/in/vidalhenrique
• Published advisory: CVE-2026-45436 (WPBakery Page Builder, broken access control)

This page is the official link between the researcher handle used on disclosure platforms and the real identity above.

Reporting a vulnerability

Reporting is not testing. Reporting something you noticed during normal use of the service, without interacting with it to probe its security, requires no authorization and is welcome at any time at security@ethancg.com.

So we can handle your report effectively, please include where possible:

• a clear description of the vulnerability (type, OWASP class if relevant);
• the affected URL, endpoint or component;
• reproduction steps (proof of concept, commands, screenshots);
• estimated impact (read/write, data accessible, authentication prerequisites);
• your contact details (name or pseudonym to credit, if applicable).

Rules of engagement: prior authorization required

Any testing activity against Ethan Consulting systems, automated or manual, requires prior written authorization. This covers authentication, access-control and rate-limit testing, the use of scanners, intercepting proxies or fuzzing tools, and the creation of any account intended for testing.

New authorizations are restricted. They are considered only for researchers with an established, verifiable track record, for example: vulnerabilities credited in their name (CVE, vendor advisories), a public ranking on a recognized disclosure platform, published research, or an engagement on behalf of an identified security firm.

To request authorization, write to security@ethancg.com stating:

• your identity and contact details;
• the evidence of your track record (links to credited vulnerabilities, platform profile, publications, employer);
• the intended scope (domains, endpoints, features);
• the methods and tools you plan to use;
• your preferred testing window and the source IP addresses you will operate from.

Authorization is granted in writing; it is personal, time-limited, restricted to the agreed scope, and revocable at any time. Ethan Consulting does not consent to any security testing of its systems carried out without this prior written authorization. No bounty is paid.

Our commitments

• Acknowledgement within 72 business hours.
• Assessment and triage, then keeping the researcher informed of remediation progress.
• Public credit on request, after the fix ships (anonymous credit available).
• No legal action against researchers who follow this policy.

Scope

The categories below define what we accept as a report and what an authorization may cover. They are not an invitation to test.

In scope: authentication, session or access-control bypasses; injections; XSS with demonstrated execution; CSRF on sensitive actions; SSRF, LFI/RFI; IDOR granting access to another user's data; exposure of secrets or credentials; privilege escalation; payment-flow or quota bypass.

Out of scope: missing HTTP headers without a demonstrated exploit; self-XSS and clickjacking without a sensitive action; user enumeration by design; denial of service (DoS, DDoS), do not attempt; automated-scan findings without manual validation; client-side-only bypasses with no server-side effect; email, SMS or notification send-abuse; duplicates already identified internally or reported by a third party.