Vulnerability Disclosure Policy

Haxset is committed to the security of our systems and the people who use them. This policy tells security researchers what they may test, how to test it, and how to send us vulnerability reports. We encourage you to contact us with any vulnerability you find.

Authorization

If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized. We will work with you to understand and resolve the issue quickly, and Haxset will not recommend or pursue legal action related to your research. If a third party initiates legal action against you for activities conducted in accordance with this policy, we will make this authorization known.

Guidelines

Under this policy, you must:

• notify us as soon as possible after you discover a real or potential security issue;
• make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data;
• access only the minimum data needed to demonstrate the vulnerability, and use exploits only to the extent necessary to confirm it;
• not use an exploit to compromise or exfiltrate data, establish persistent access, or pivot to other systems;
• stop testing and report to us immediately once you have established that a vulnerability exists, or if you encounter sensitive data such as personal, financial or proprietary information, and not disclose that data to anyone else;
• delete any data you obtained once your report has been resolved.

Scope

This policy applies to:

• haxset.com

If you come across a vulnerability in another system operated by Haxset LLP, please report it under this policy, but do not actively test other systems without our written permission.

The following are not authorized:

• denial-of-service or load testing of any kind;
• social engineering of Haxset staff or contractors, including phishing and phone calls;
• physical testing of offices or facilities;
• testing of third-party services we use, such as Cloudflare, Microsoft 365 or our email provider; report issues in those services to the vendor;
• any system or data belonging to our clients. Client engagements are governed by separate agreements.

If you are not sure whether a system is in scope, contact us before you start testing.

Reporting a vulnerability

Email [email protected] with the subject line "Security report". Reports may be written in English or Arabic, and you may submit them anonymously. Please include:

• where the vulnerability was found (URL, parameter, component);
• its potential impact;
• the technical detail we need to reproduce it, such as steps, proof-of-concept code or screenshots.

Our security.txt file lists the same contact details in machine-readable form.

What you can expect from us

• We will acknowledge your report within 3 business days.
• We will confirm whether the vulnerability exists, keep you informed of our remediation progress, and be as transparent as we can about what we are doing.
• Please give us a reasonable amount of time to fix the issue before you disclose it publicly; we will coordinate the timing with you.

No bug bounty

We do not run a bug bounty programme and do not offer monetary rewards for reports. With your permission, we are happy to acknowledge your contribution publicly once the issue is fixed.

Questions

Questions about this policy can be sent to [email protected]. See also our Terms of Use.