Vulnerability Disclosure Policy

Last updated: placeholder: date.

Our commitment

We want to hear about security problems in our products and our website. If you report one in good faith under this policy, we will not pursue legal action against you, we will acknowledge your report, and we will keep you informed until it is resolved.

Scope

In scope: placeholder: domain and its subdomains; the Regulaxy software distributed by us placeholder: supported versions.

Out of scope: third-party services we do not operate; customers' own Regulaxy installations (report those to the customer — we will help coordinate if you ask); findings from automated scanners with no demonstrated impact; missing security headers or best-practice deviations without a working exploit path; social engineering of our staff; physical attacks; denial-of-service testing.

How to report

Email security@placeholder: domain, encrypted with our PGP key at /.well-known/pgp-key.txt if the finding is sensitive.

Please include: what the issue is, where it is, how to reproduce it step by step, what an attacker could achieve, and any proof-of-concept. Hebrew or English are both fine.

What we ask of you

• Give us reasonable time to fix it before disclosing publicly — we ask for 90 days, and will tell you if we need longer and why.
• Do not access, modify or delete data that is not yours. If you encounter personal data, stop and tell us.
• Do not degrade our service or our customers'. No denial-of-service, no spam, no automated high-volume scanning.
• Test only against systems in scope, and only against your own accounts.

What we commit to

We will credit you in our advisory and on /trust/hall-of-fame if you would like to be named.

Rewards

placeholder: We do not currently operate a paid bug-bounty programme. — Say this plainly if it is true. Do not imply a reward that does not exist.

Safe harbour

Activity conducted in a manner consistent with this policy will be considered authorised. We will not initiate or support legal action against you for it, and if a third party brings action against you for such activity, we will make it known that your actions were authorised. This does not cover activity outside this policy, and it cannot waive the rights of third parties. counsel: safe-harbour wording must be lawyer-reviewed — it is a binding promise.