Vulnerability Reporting Policy
Security Phoenix Ltd (trading Phoenix Security) takes the protection of our customer and member data seriously. We are grateful for the investigative work into security vulnerabilities that is carried out by well-intentioned, ethical security researchers. We are committed to collaborating with the information security community to investigate and resolve security issues within our websites, online services that are reported to us by this Vulnerability Reporting Policy. We want to hear from you if you have information about potential security vulnerabilities to Security Phoenix Ltd (trading Phoenix Security), website and app.
Bug Bounties
Security Phoenix Ltd (trading Phoenix Security) does not offer a bug bounty program or other rewards for security disclosures. However, we appreciate the efforts of security researchers who take the time to investigate and report security vulnerabilities to us in accordance with this policy.
Scope
This program is not a means to submit complaints about Security Phoenix Ltd (trading Phoenix Security) services or products, or for inquiries regarding the availability of company web sites or online services.
The following types of vulnerabilities are considered out of the scope for the purposes of this program:
Security Phoenix Ltd (trading Phoenix Security) may update this policy at any time, including by making changes to list of out-of-scope vulnerabilities.
Reporting a Vulnerability
If you have discovered an issue that you believe is an in-scope vulnerability, please email securityreporting@phoenix.security. Please include the following, as applicable:
Offering a solution is encouraged but not required to report a vulnerability. Lack of detailed vulnerability explanation may result in delays in our response and subsequent potential actions on the finding.
In case there is a significant proven and confirmed potential damage to the organization with a PoC that could potentially impact we might provide a token of appreciation.
Guidance
This policy prohibits the performance of the following activities:
Security researchers must not violate any law, or access, use, alter or compromise in any manner any Security Phoenix Ltd (trading Phoenix Security).
If you have any questions regarding this policy or the guidance above, please get in touch with our security team for guidance: securityreporting@phoenix.security
What to Expect
Upon receipt of the vulnerability report, Security Phoenix Ltd (trading Phoenix Security) or one of it’s representatives may send an automated response as acknowledgement. Security Phoenix Ltd (trading Phoenix Security) may contact reporter(s) if additional information is needed to assist with a follow-up investigation. For the security of our customers, Security Phoenix Ltd (trading Phoenix Security) will not disclose, discuss, or confirm security issues.
Public Notification
In order to protect our customers, Security Phoenix Ltd (trading Phoenix Security) requests that security researchers not post or share any information about a potential vulnerability in any public setting until we have researched, responded to, and addressed the reported vulnerability and informed customers and stakeholders as needed. The time to address a valid, reported vulnerability will vary based on impact of the potential vulnerability and affected systems.
Policy Definitions
Vulnerability: A weakness in the design, implementation, operation or internal control of a process that could expose the system to adverse threats from threat events.
Denial of Service (DoS): An attack on a service from a single source that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate.
Distributed Denial of Service (DDoS): An attack on a service from multiple compromised computer systems that floods it with so many requests that it becomes overwhelmed and is either stopped completely or operates at a significantly reduced rate, thereby denying service to legitimate users or systems.
Transport Layer Security (TLS): A protocol that provides communications privacy over the Internet. The protocol allows client/server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery.
Self-Cross-Site Scripting (XCSS): A social engineering attack to gain control of a victim’s web accounts via the victim unknowingly running malicious code on their own web browser.
Cross-Site Request Forgery (CSRF): A type of malicious exploit of a web site where unauthorized commands are transmitted from a user that the web site trusts. This is also known as a one-click attack or session riding.
Effective Date
The effective date of this policy is January 20, 2023.
Get all the latest news, exclusive deals, and feature updates.