.svg)
Security Policy
Pravica's Responsible Disclosure Policy
Last updated: 17 March 2022
Introduction
We take the security of our customer's data very seriously. If you believe you've discovered a potential security vulnerability within one of Pravica's services or products, we strongly encourage you to disclose it to us as quickly as possible and in a responsible manner.
We appreciate the assistance and patience of security researchers and are committed to reviewing all reports that are disclosed to us. We will do our best to address each issue in a timely fashion, and request that you provide us with a reasonable timeframe to address the issue before public disclosure.
Please do not publicly disclose the details of any potential security vulnerabilities without express written consent from us.
To encourage responsible disclosure, we will not take legal action against security researchers in relation to the discovery and reporting of a potential security vulnerability instead, we will offer rewards to the eligible reports. This is provided that all such potential security vulnerabilities are discovered and reported strictly in accordance with this Responsible Disclosure Program. In the event of any non-compliance, we reserve all of our legal rights.
If in doubt, please contact us by sending an email to s3@pravica.io
Please do not publicly disclose the details of any potential security vulnerabilities without express written consent from us.
To encourage responsible disclosure, we will not take legal action against security researchers in relation to the discovery and reporting of a potential security vulnerability instead, we will offer rewards to the eligible reports. This is provided that all such potential security vulnerabilities are discovered and reported strictly in accordance with this Responsible Disclosure Program. In the event of any non-compliance, we reserve all of our legal rights.
If in doubt, please contact us by sending an email to s3@pravica.io
Discovering Potential Security Vulnerabilities
We encourage you to conduct responsible security research on our products and services. We allow you to conduct vulnerability research and testing only on our services and products to which you have authorized access.
The following types of research are strictly prohibited:
* Accessing or attempting to access accounts or data that does not belong to you
* Any attempt to modify or destroy any data
* Executing or attempting to execute a denial of service (DoS) attack
* Sending or attempting to send unsolicited or unauthorized email, spam or any other form of unsolicited messages
* Conducting social engineering (including phishing) of Pravica employees and customers, contractors or any other party
* Posting, transmitting, uploading, linking to, sending or storing malware, viruses or similar harmful software that could impact our services, products or customers or any other party
* Testing third party websites, applications or services that integrate with our services or products
* The use of automated vulnerability scanners
* Exfiltrating any data under any circumstances
* Any activity that violates any law
The following finding types are excluded from this Responsible Disclosure Program
Our apps and services are built on top of web3 technologies so there might be issues that are totally not applicable, they can be but not limited to:
* Reports from automated vulnerability scanners.
* Descriptive error messages such as stack traces, application or server errors.
* HTTP 404 codes or pages, or other HTTP non-200 codes or pages.
* Fingerprinting or banner disclosure on common and public services.
* Disclosure of known public files or directories, such as robots.txt.
* Clickjacking with minimal security implications.
* CSRF on forms that are available to anonymous users, such as contact, login and logout forms.
* CSRF with minimal security implications.
* Content spoofing or text injection.
* Presence of application or web browser 'autocomplete' or 'save password' functionality.
* Lack of Secure or HTTPOnly flags on non-sensitive cookies.
* Login or Forgot Password page brute force and account lockout not enforced.
* Enabled HTTP methods (such as OPTIONS, TRACE, DELETE, PUT, WEBDAV, etc.) without a valid attack scenario.
* Missing HTTP security headers, such as Strict Transport Security, X-Frame-Options, X-SSS-Protection, etc.
* Host header or CSV injection without a valid attack scenario.
* DNS cache poisoning. * Missing best practices in SSL/TLS configuration without a working proof of concept.
* Self-exploitation issues (such as self XSS, cookie reuse, self denial of service, etc.).
* Issues related to mobile applications that require the host device to be either rooted or jailbroken.
* Issues related to brute forcing, rate limiting and other denial of service type attacks.
* Weak password policy implementation.
* Use of known-vulnerable libraries or frameworks (e.g. outdated programming languages) without a valid attack scenario.
* Issues that rely on outdated or unpatched browsers and platforms to be abused.
The following types of research are strictly prohibited:
* Accessing or attempting to access accounts or data that does not belong to you
* Any attempt to modify or destroy any data
* Executing or attempting to execute a denial of service (DoS) attack
* Sending or attempting to send unsolicited or unauthorized email, spam or any other form of unsolicited messages
* Conducting social engineering (including phishing) of Pravica employees and customers, contractors or any other party
* Posting, transmitting, uploading, linking to, sending or storing malware, viruses or similar harmful software that could impact our services, products or customers or any other party
* Testing third party websites, applications or services that integrate with our services or products
* The use of automated vulnerability scanners
* Exfiltrating any data under any circumstances
* Any activity that violates any law
The following finding types are excluded from this Responsible Disclosure Program
Our apps and services are built on top of web3 technologies so there might be issues that are totally not applicable, they can be but not limited to:
* Reports from automated vulnerability scanners.
* Descriptive error messages such as stack traces, application or server errors.
* HTTP 404 codes or pages, or other HTTP non-200 codes or pages.
* Fingerprinting or banner disclosure on common and public services.
* Disclosure of known public files or directories, such as robots.txt.
* Clickjacking with minimal security implications.
* CSRF on forms that are available to anonymous users, such as contact, login and logout forms.
* CSRF with minimal security implications.
* Content spoofing or text injection.
* Presence of application or web browser 'autocomplete' or 'save password' functionality.
* Lack of Secure or HTTPOnly flags on non-sensitive cookies.
* Login or Forgot Password page brute force and account lockout not enforced.
* Enabled HTTP methods (such as OPTIONS, TRACE, DELETE, PUT, WEBDAV, etc.) without a valid attack scenario.
* Missing HTTP security headers, such as Strict Transport Security, X-Frame-Options, X-SSS-Protection, etc.
* Host header or CSV injection without a valid attack scenario.
* DNS cache poisoning. * Missing best practices in SSL/TLS configuration without a working proof of concept.
* Self-exploitation issues (such as self XSS, cookie reuse, self denial of service, etc.).
* Issues related to mobile applications that require the host device to be either rooted or jailbroken.
* Issues related to brute forcing, rate limiting and other denial of service type attacks.
* Weak password policy implementation.
* Use of known-vulnerable libraries or frameworks (e.g. outdated programming languages) without a valid attack scenario.
* Issues that rely on outdated or unpatched browsers and platforms to be abused.
How to Report a Potential Security Vulnerability?
You can responsibly disclose potential security vulnerabilities to the Pravica Security Team by emailing s3@pravica.io Ensure that you include details of the potential security vulnerability and exploit with enough information to enable the Security Team to reproduce your steps.
When reporting a potential security vulnerability, please include as much information as possible, including:
* An explanation of the potential security vulnerability;
* A list of products and services that may be affected (where possible);
* Steps to reproduce the vulnerability;
* Proof-of-concept code (where applicable);
* The names of any test accounts you have created (where applicable); and
* Your contact information.
What Happens Next?
Once you have reported a potential security vulnerability, we will contact you within 72 hours with an initial response. Going forward, we will keep you informed on our progress towards addressing the potential security vulnerability and will also notify you when the matter has been addressed and our final decision regarding the reward.
We offer rewards to the eligible issues from only recognizing the issue and thanking the researcher through our email, listing in our Hall of Fame to other reward we may decide based on the reported issues severity.
Subject to any regulatory and legal requirements, all reports will be kept strictly confidential, including the details of the potential security vulnerability as well as the identity of all researchers involved in reporting it. Once the investigation has been completed we may, subject to the researchers' consent, publicly recognize the researchers involved. If a report is found to be a duplicate or is otherwise already known to us, the report will not be eligible for any public recognition.
We ask that you maintain confidentiality and do not make your research public until we have completed our investigation and, if necessary, have remediated or mitigated the potential security vulnerability.
Please note that we may or may not compensate individuals or organizations for identifying potential or confirmed security vulnerabilities.
We offer rewards to the eligible issues from only recognizing the issue and thanking the researcher through our email, listing in our Hall of Fame to other reward we may decide based on the reported issues severity.
Subject to any regulatory and legal requirements, all reports will be kept strictly confidential, including the details of the potential security vulnerability as well as the identity of all researchers involved in reporting it. Once the investigation has been completed we may, subject to the researchers' consent, publicly recognize the researchers involved. If a report is found to be a duplicate or is otherwise already known to us, the report will not be eligible for any public recognition.
We ask that you maintain confidentiality and do not make your research public until we have completed our investigation and, if necessary, have remediated or mitigated the potential security vulnerability.
Please note that we may or may not compensate individuals or organizations for identifying potential or confirmed security vulnerabilities.
