Security
Responsible disclosure
Found a vulnerability in our systems? Tell us first. We will work with you to fix it.
How to report
Email [email protected] with the subject "Security report". Please include:
- a description of the vulnerability and where it is
- the steps to reproduce it
- its likely impact
- how we can contact you
Our security.txt file lists the same contact.
Scope
In scope: viyuhsecurity.com and other systems owned and operated by Viyuh Security.
Out of scope: services run by third parties, such as our hosting, email and messaging providers. Please report issues in those directly to the provider.
Testing rules
Please do not:
- run denial of service attacks or anything that degrades our services
- use social engineering, phishing or physical attacks against our staff or offices
- access, change or delete data that is not yours beyond the minimum needed to show the vulnerability
- keep, share or publish any personal data you come across
- disclose the vulnerability publicly before we have had a reasonable time to fix it
If you come across personal data, stop and report it to us straight away.
What we commit to
- We will acknowledge your report and keep you informed as we work on it.
- We will credit you publicly once the issue is fixed, if you would like that.
- We will not take legal action against you for research that is done in good faith and follows this policy.
We do not run a paid bug bounty programme. This policy does not authorise testing of any system we do not own.