Responsible Disclosure
All IT systems can have bugs and weaknesses. Some of them can compromise the integrity, privacy and availability of our services. Handling such findings responsibly matters to us, and the following policy describes how we do it. Our main objective is a constructive dialogue with you, so that any issue found can be discussed, confirmed and resolved.
How to report
If you encounter such an issue in connection with our websites, products or services, please tell us at disclosure@amidiro.com.
Please give us enough technical information to reproduce the finding, for example:
- web server IP address and name
- IP address of the exploring system
- the kind of vulnerability (code injection, RXSS, DoS and so on)
- an explanation, HTTP request or API call that demonstrates it
What we will do
- We will send you qualified feedback about the finding.
- We will stay in touch with you until the issue is resolved.
- We will work to resolve it as quickly as its severity requires.
What we ask of you
- Inform us as soon as you encounter a finding.
- Do not use the finding to dig deeper into our systems or anyone else’s, to extract data, or to harm systems or rights.
- Do not disclose the finding publicly before we have resolved it or explained why we disagree.
- Do not use physical force, social engineering, denial-of-service attacks or any other measure that could harm our rights or those of others.