Purpose
The purpose of this policy is to establish a clear and standardized process for reporting security vulnerabilities related to NumberGuru’s products, services, websites, and infrastructure. NumberGuru is committed to ensuring the safety and privacy of its users and believes that responsible disclosure of vulnerabilities helps achieve this goal.
Scope
This policy applies to:
- All public-facing systems and services operated by NumberGuru;
- Web and mobile applications under NumberGuru’s control; and
- Any related assets that could reasonably be impacted by a vulnerability.
Testing & Disclosure Rules
- No Denial of Service (DoS) Testing: Do not conduct any form of Denial of Service attack or actions that might cause service outages or degradation.
- No Physical or Social Engineering: Physical or social engineering attacks (e.g., phishing, pretexting) are strictly prohibited.
- No Testing of Third-party Services: Testing should not extend to services not owned or operated by NumberGuru or its direct partners.
- No Uploading of Vulnerability or Client Data: Vulnerability details or any client-related content must not be uploaded to third-party platforms (e.g., GitHub, Dropbox, YouTube).
- Professional Language in Payloads: All attack payloads and findings must be presented in a professional, clear, and concise manner, with appropriate language.
- Limit Access and Reporting: If access to systems, accounts, users, or user data is gained, immediately cease further exploration at the point of recognition and report it. Do not attempt to further assess the scope of accessible data.
- Confidentiality of Vulnerabilities: All vulnerabilities submitted through this program are confidential and should not be discussed or disclosed without approval from all involved parties.
Reporting a Vulnerability
We encourage security researchers and members of the public to report potential vulnerabilities in a responsible manner.
To report a vulnerability, please contact us at: [email protected]
Include the following information where possible:
- A clear and concise description of the vulnerability;
- Steps to reproduce the issue (proof-of-concept scripts are appreciated);
- The potential impact of the issue; and
- Any supporting materials (e.g., screenshots, logs).
Safe Harbor
We will not pursue legal action against individuals who:
- Report vulnerabilities in good faith;
- Follow this policy and conduct their testing responsibly; and
- Avoid privacy violations, service disruptions, and destruction of data.
Changes to Policy
We may update this policy from time to time. The most current version will always be available at: https://www.numberguru.com/privacy-policy/.