Vulnerability Disclosure Policy

Guidelines

Under this policy, “research” is defined as activities in which you:

• Notify us as soon as possible after you discover a potential or real security issue.
• Make every effort to prevent breaches of privacy, degradation of user experience, any disruption to production systems, and the manipulation or destruction of data.
• Only use exploits to the extent that is necessary to confirm that a vulnerability is present. Do not use an exploit to compromise or exfiltrate data, establish access to a system, or otherwise use the exploit to pivot to other systems.
• Provide us with a reasonable amount of time to resolve the issue before you disclose it publicly.
• Do not submit a substantial volume of low-quality reports.

After confirming the presence of a vulnerability or discovering any sensitive data (such as personal identification details, financial information or records, or any third party's proprietary information or trade secrets), you must stop all tests, notify us immediately, and refrain from sharing this data with anyone else.

Important

When reporting issues, please omit any sensitive or personal information (such as personal identification details, financial information or records, or any third party's proprietary information or trade secrets) in any evidence provided.

You may only access and interact with accounts you own or accounts where you have explicit permission from the account holder(s). The methods employed to examine or validate an issue should be in line with what is generally considered reasonable and in good faith, such as, including without limitation:

• Do not cause potential or actual damage to our systems, applications, or users. For example, deploying brute force attacks to gain access to our applications, products, or services. DDOS or any other disruptive testing.
• Automated scraping and fuzzing or conducting large or blind scans using automation tools are strictly prohibited.
• Do not perform attacks that target data centers, partners, affiliates, and / or personnel property.
• Do not conduct social engineering activity (e.g., phishing, smishing, vishing), to gain access to any Forward Thinking Systems personnel, colleague, application, product, or service.
• Do not exploit a vulnerability (known or otherwise) to view unauthorized or corrupt data. When validating exfiltration, please test only the minimum amount necessary to demonstrate or validate the issue. Refrain from downloading any more data than absolutely necessary to demonstrate the issue or modifying or deleting any data.

Reporting vulnerabilities

If a vulnerability is discovered, the researcher must provide a detailed summary of the vulnerability, including (but not limited to) the following:

• Clear descriptions of the vulnerability and its potential impact;
• Product name, version, and configuration of any software or hardware that may be potentially affected;
• Step-by-step directions to reproduce the issue;
• A proof-of-concept; and suggested remediation or mitigation steps, as appropriate.

We accept vulnerability reports submission via email to [email protected]. Reports may be submitted anonymously if necessary. If you share contact information with us, we will acknowledge receipt of your report within three business days.

By submitting a vulnerability, you acknowledge that any potential reward is at the discretion of Forward Thinking Systems, that you have no expectation of compensation and that you expressly waive any future pay claims against Forward Thinking Systems.

What we would like to see from your submission

To help us address and prioritize vulnerability submissions, we recommend that your vulnerability reports:

• Describe the location that the vulnerability was discovered and the potential impact of using the exploit.
• Offer a thorough description of the steps needed to reproduce the vulnerability (screenshots or proof of concept scripts are recommended).
• Are disclosed in English, if possible.

What can you expect from us

If you choose to share your contact information with us, we will commit to coordinating with you as quickly and openly as possible.

• We will acknowledge that your vulnerability report has been received within 3 business days.
• To the best of our ability, we will confirm the existence of the vulnerability to you and be as open as possible about our remediation process, including the issues or challenges that may delay a resolution.
• We will endeavor to maintain an open dialogue to discuss the issue(s).

Questions

Questions regarding this policy may be sent directly to [email protected]. We also invite you to contact us with suggestions for improving this policy.