This Finoserv responsible disclosure policy explains how to report a security vulnerability in our website and what you can expect from us. We welcome reports from security researchers and anyone else who finds a problem, and we will work with you in good faith.
Our contact details for security reports are also published in machine-readable form at /.well-known/security.txt, following RFC 9116.
Scope
In scope:
- finoserv.com
- subdomains of finoserv.com that are operated by Finoserv
Out of scope:
- apps and systems that we build or run for clients, which belong to those clients; please report issues to the client concerned, using their own disclosure process
- third-party services we use, such as our hosting, content delivery, analytics and marketing providers; please report those to the provider
- denial-of-service or load testing, and any test that degrades the website for others
- social engineering, phishing or physical attacks against our staff, offices or partners
- spam or volume testing of the contact form
- reports from automated scanners without a demonstrated, exploitable impact
- missing security headers, cookie flags, or email records such as SPF, DKIM and DMARC, without a demonstrated impact
- clickjacking on pages with no sensitive actions
- self-XSS, and issues that need an outdated browser, a rooted device, or physical access to a device
- disclosure of software version numbers or banners without a working exploit
How to report
Email [email protected]. If our security.txt file lists an encryption key, please use it for sensitive details.
Please include:
- a description of the vulnerability and its potential impact
- the affected URL, subdomain or component
- clear steps to reproduce it, with any proof-of-concept code, requests or screenshots
- the date and time of your testing and the IP addresses you used, if you can share them
- how you would like to be credited, if at all, and how to reach you
Write in English if you can. One issue per report helps us respond faster.
Rules for testing
When you test, please:
- only test against accounts and data you own or have permission to use
- stop as soon as you confirm a vulnerability, and do not access, change, download or delete data that is not yours
- if you encounter personal data, stop, do not keep a copy, and tell us in your report
- do not use the vulnerability to move further into our systems or keep access
- keep the details confidential until we have fixed the issue or agreed a disclosure date with you
- comply with all applicable laws
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not take legal action against you or ask law enforcement to investigate you for that research. This includes claims under anti-hacking laws, such as the U.S. Computer Fraud and Abuse Act, and claims under anti-circumvention laws, such as the Digital Millennium Copyright Act, for circumventing technology measures to the extent needed to test.
If a third party brings legal action against you for research done in line with this policy, we will make it known that your actions were authorized by us. We cannot authorize testing of systems that belong to others, including our clients and providers.
If you are unsure whether a test is allowed, ask us at [email protected] before you go ahead.
What we commit to
- Acknowledge your report within 3 business days.
- Give you an initial assessment, including whether we can reproduce the issue, within 10 business days.
- Keep you updated at least every 14 days while we work on a fix.
- Aim to fix confirmed vulnerabilities within 90 days, depending on severity and complexity, and tell you if we need longer.
- Agree a coordinated disclosure date with you. We ask that you wait until a fix is in place, or 90 days after your report, whichever comes first, unless we agree otherwise.
- Credit you publicly, with your permission, once the issue is fixed.
Rewards
We do not run a paid bug bounty program at this time. We do not pay for reports unless we have stated a reward in writing in advance. We are grateful for every valid report and are happy to give credit.
Changes to this policy
We may update this policy. The current version and date are shown at the top of this page.