Coordinated Vulnerability Disclosure Policy

How we handle vulnerability reports and their disclosure

Purpose

BudgetBakers welcomes the responsible reporting of security vulnerabilities in its products.

The purpose of this policy is to enable security researchers, users and other parties to safely report potential vulnerabilities, and to allow them to be investigated and remediated before technical details are made public.

Scope

This policy applies to potential security vulnerabilities in BudgetBakers products. It also covers vulnerabilities in third-party components where:

  • The component is integrated into a BudgetBakers product, or
  • Its vulnerability affects the security of a BudgetBakers product

It does not apply to standalone third-party products that are not part of a BudgetBakers product and have no impact on its security.

Security research rules

BudgetBakers asks reporters to:

  • Act in good faith and with the aim of improving security
  • Test only their own accounts and their own data wherever possible
  • Minimise access to other users' data
  • Not copy or retain personal or financial data unless necessary to demonstrate the vulnerability
  • Stop further testing in that direction if they accidentally access another user's data
  • Not disrupt the availability of the service
  • Not perform DoS/DDoS testing
  • Not use social engineering against employees or users
  • Not carry out physical attacks
  • Not perform destructive testing
  • Not use any access obtained for any purpose other than verifying the vulnerability

What happens after you report

Once we receive a report, BudgetBakers will:

  1. 1Log the report
  2. 2Carry out an initial security triage
  3. 3Request additional information from the reporter if needed
  4. 4Verify the reproducibility and impact of the vulnerability
  5. 5Determine how to remediate or mitigate it
  6. 6Coordinate any public disclosure
  7. 7Inform the reporter of the outcome, where appropriate

Coordinated disclosure

We ask reporters not to publish technical details of a vulnerability before a fix or appropriate mitigation is available to users, or before another date agreed with BudgetBakers.

BudgetBakers will strive to coordinate disclosure with the reporter in a reasonable and transparent manner.

Bug bounty

BudgetBakers does not currently operate a public bug bounty programme. Reporting a vulnerability does not in itself entitle the reporter to a financial or other reward.

In exceptional cases, BudgetBakers may, at its sole discretion, offer a reward for a particularly significant or well-documented security finding.

Responsible research / safe harbour

BudgetBakers does not intend to take legal action solely on the grounds of security research carried out in good faith and in accordance with this policy.

This does not apply to conduct intended to harm the company, its users or third parties, or to conduct that clearly exceeds what is necessary to verify the vulnerability.

Found a vulnerability?

Report it through our security contact point.

Report a Security Vulnerability