DisclosureOps Vulnerability Disclosure Policy

We value the input of our community acting in good-faith to help us maintain a high standard for the security and privacy of our users. This includes encouraging responsible vulnerability research and disclosure. This policy sets out our definition of good-faith in the context of finding and reporting vulnerabilities, as well as what you can expect from us in return.

If you have identified a security issue, see "How to Report" below.

Scope

This policy applies to any digital assets owned, operated, or maintained by DisclosureOps for which we can legally authorise security testing.

Out-of-Scope

The following are explicitly out of scope:

• Assets or other equipment not owned or maintained by us, unless explicitly included in the "Scope" section.
• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing HTTP security headers.
• Theoretical SSL/TLS findings with no demonstrated impact.
• Missing cookie flags on non-sensitive cookies.
• Missing best practices without an exploitable scenario.
• Issues relating to the configuration of SPF, DKIM, DMARC, or other email security records.
• Social engineering, phishing, or physical attacks against our staff or offices.
• Denial of service testing.

How to Report

Please report security issues via disclosureops@reports.disclosureops.co.nz, providing all relevant information. The more details you provide, the easier it will be for us to triage and fix the issue. Please write the report in English and ensure the following details are included:

• Type of security issue.
• The affected system(s).
• Full steps to reproduce the issue including any proof of concepts, scripts, images, or screen recordings.
• Whether the security issue has been published or shared with others.
• What you believe to be the impact of the issue, including any possible exposure of personal information.

Our Commitments

When working with us according to this policy, you can expect us to:

• Work with you to understand and validate your report, including a timely initial response to the submission within 3 business day(s).
• Work to remediate discovered vulnerabilities in a timely manner, within our operational constraints.
• Strive to keep you informed about the progress of a vulnerability as it is processed.
• Extend Safe Harbour for your vulnerability research that is related to this policy.
• Treat the information you share with us as confidential unless we have to disclose it. This may happen if:
  • A third party discovers the security issue within our system before we have had the opportunity to resolve it.
  • The nature of the security issue requires us to follow local laws and legislation to notify third parties, such as the Privacy Act 2020.
• Respond to you in English.

Rewards

This program does not currently offer rewards or payment for reported vulnerabilities.

Disclosure Policy

• Report vulnerabilities to us via our official channel, disclosureops@reports.disclosureops.co.nz, and do not discuss them publicly until we've had a chance to address them.
• We will make our best effort to meet the following timelines for received reports:
  • We will acknowledge receipt of your report within 3 business day(s).
  • We ask that you refrain from public disclosure until we've had 90 day(s) to remediate the issue, and we will work with you on timing if more time is needed.

Ground Rules

To encourage vulnerability research and to avoid any confusion between legitimate research and malicious attack, we ask that you attempt, in good faith, to:

• Play by the rules. This includes following this policy and any other relevant agreements.
• Report any vulnerability you've discovered promptly.
• Avoid violating the privacy of others, disrupting our systems, destroying data, and/or harming user experience.
• Use only the official channel(s) to discuss vulnerability information with us.
• Handle the confidentiality of details of any discovered vulnerabilities according to our Disclosure Policy.
• Perform testing only on in-scope systems, and respect systems and activities which are out-of-scope.
• (If a vulnerability provides unintended access to data) Limit the amount of data you access to the minimum required for effectively demonstrating a Proof of Concept.
• Cease testing and submit a report immediately if you encounter any user data during testing, such as Personal Information (PI), credit card data, or proprietary information.
• Only interact with test accounts you own or with explicit permission from the account holder.
• Not engage in extortion.

Safe Harbour

When conducting vulnerability research according to this policy, we consider this research conducted under this policy to be:

• Authorised in view of any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good faith violations of this policy.
• Authorised in view of relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls.
• Exempt from restrictions in any Acceptable Usage Policy we publish that would interfere with conducting security research, and we waive those restrictions on a limited basis.
• Lawful, helpful to the overall security of the Internet, and conducted in good faith.

You are expected, as always, to comply with all applicable laws. If legal action is initiated by a third party against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please submit a report through disclosureops@reports.disclosureops.co.nz before going any further.

Adapted from the disclose.io vulnerability disclosure policy framework, CC0-1.0.

Generated with https://disclosureops.co.nz