Responsible disclosure
Found a hole in our systems? We'd rather hear it from you.
We test other people's security for a living, so we'd be hypocrites not to welcome reports about our own. Act in good faith and we won't pursue legal action. Simple as that.
How to report
Email security@bits-innovate.com with a description of the issue, steps to reproduce, the affected URL or asset, and the impact you believe it has. Screenshots or a short video help. Please give us reasonable time to fix things before telling anyone else.
In scope
- +bits-innovate.com and all subdomains
- +Any application or API operated by BITS
Out of scope
- −Client systems. Report those to the client directly
- −Denial of service, load or volumetric testing
- −Social engineering or phishing of BITS staff
- −Physical attacks against offices or data centres
- −Missing best-practice headers with no demonstrated impact
- −Findings from automated scanners without a working proof
Ground rules
- Only access data you need to prove the issue. Never modify or delete it.
- Stop and report as soon as you reach personal data or credentials.
- Don't degrade service for other users.
- Keep the details confidential until we've confirmed a fix.