-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 We will investigate legitimate reports and make every effort to quickly resolve any vulnerability. Please make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of my services. We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. We consider activities conducted consistent with this policy to constitute “authorised” conduct under the Computer Fraud and Abuse Act. We will not bring a DMCA claim against you for circumventing the technological measures we have used to protect the applications in scope of this program. If legal action is initiated by a third party against you and you have complied with this security policy,we will take steps to make it known that your actions were conducted in compliance with this policy. It is also important to note, we will not take legal action against you simply for providing us with a proof of concept of the security vulnerability. Please follow the guidelines listed in the Proof of concepts section below to ensure that your proof of concept is detailed enough to demonstrate the issue and still follows the guideline listed above. If you have any questions or concerns about about our disclosure policy, please do not hesitate to contact us via security+policy@reports.bairwell.com Service-level agreement ====================== we will make a best effort to reply within 5 business days (we are only a very small business with disabled members of staff - and family takes priority over technology!). In-Scope ======== Any website or server which has a security.txt file pointing to this document and which is PGP/GPG signed using the valid in-date PGP key at: https://reports.bairwell.com/.well-known/security/pgpkey.txt If you are unsure if we are responsible for a system, please contact us at: security+policy@reports.bairwell.com Rewards ======= There is very little we can offer you as a reward (apart from our thanks). However, we may be able to find some loose change if you find an issue which could result in our msall business having major issues. Exclusions - Test Types ======================= The following test types are excluded from the scope: * Findings from physical testing such as office/residential access (e.g. open doors, tailgating). * Findings derived primarily from social engineering (e.g. phishing, vishing). * Findings from applications or systems not listed in the "In-Scope" section. We do accept high-severity issues on out of scope assets if they directly affect us. * Vulnerability reports with video only PoCs. * Reports that state that software is out of date or vulnerable without a proof of concept. * Highly speculative reports about theoretical damage. Be concrete. * Vulnerabilities as reported by automated tools without additional analysis as to how they’re an issue. * Issues in third-party services should be reported to the respective team. Exclusions - Issue Types ======================== * Network-level Denial of Service (DoS/DDoS) vulnerabilities. * Low severity issues that can be detected with tools such as Hardenize and Security Headers. * Content injection issues * Cross-site Request Forgery (CSRF) with minimal security implications (Logout CSRF, etc.). * Missing cookie flags. * UI and UX bugs (including spelling mistakes) * 401 injection * Host header issues without an accompanying proof-of-concept demonstrating vulnerability. * Open ports without an accompanying proof-of-concept demonstrating vulnerability. * Banner grabbing issues (figuring out what servers are used) * Missing X-Frame-Options header * Cross-site tracing * CSP uses unsafe-inline * Disclosure of robots.txt file * Email spoofing (SPF misconfigurations) * Open redirect using Host header * Stack traces that disclose information for open source projects located on Github (basis of this security policy from https://hackerone.com/ed?type=team&view_policy=true ) -----BEGIN PGP SIGNATURE----- iHUEARYKAB0WIQTUmm0CraBP5tmNZQk51FBk0zMswAUCYo1MvwAKCRA51FBk0zMs wOz2AP9u9Zk63kzBhHye29FC4CTOPvvIo71zNyx7vwhTlxai8gEAkm4CmCyZW0in K4umM+hPPUEfhZdehfnAG7D6wdP8YA8= =I2eX -----END PGP SIGNATURE-----