At Paisr, we believe that the security of our systems, our network and our products is very important. We pay a lot of attention to this during development and maintenance. However, sometimes vulnerabilities escape detection. We appreciate you notifying us if you find one. We would prefer to hear about it as soon as possible so that we can take measures to protect our customers.
This document describes the procedure we have prepared for this.
Reporting
If you believe you've found a security issue in our product or service, please notify us as soon as possible by emailing us a detailed report about the vulnerability at security@paisr.tech.
Rules
Do not share information about the security problem with others until the problem is resolved.
- Provide information about how and when the vulnerability or malfunction occurs. Clearly describe how this problem can be reproduced and provide information about the method used and the time of investigation.
- Be responsible with the knowledge about the security problem. Do not perform any actions beyond those necessary to demonstrate the security problem. Do not abuse the vulnerability and do not keep confidential data obtained through the vulnerability in the system.
- Leave your contact details (e-mail address) if you want, so that Paisr can contact you about the assessment and progress of the vulnerability solution. We also take anonymous reports seriously.
- Do not use physical attacks, DDOS attacks or social engineering.
Our responsible disclosure policy is not an open invitation to actively scan our network for vulnerabilities. Our systems are being monitored continuously and as a result, there is a good chance that a scan will be detected and our security team will investigate it.
Exclusions
This responsible disclosure policy is not intended for reporting complaints. The policy is also not intended for:
- Reporting that the website is not available.
- Reporting fake e-mails (phishing e-mails).
- Reporting fraud.
For issues on the above and any other inquiries please get in touch with our support team.
Excluded Systems/problems
Not all systems that are accessible under our logos fall under Paisr's direct control. Although we also take reports regarding these systems very seriously, we do not offer rewards for them. We also exclude specific problems that in our opinion do not constitute a threat outside of a laboratory set-up.
Excluded Systems
www.paisr.techstatus.paisr.techidentity.paisr.techoauth-live.paisr.techoauth-staging.paisr.tech
Excluded Types of Security Problems
- (D)DOS attacks
- DNSSEC warnings
- Problems that amount to self-XSS
- Error messages without sensitive data
- Reports from which software we use can be deduced
- Problems that require the use of heavily outdated operating systems, browsers or obsolete plug ins
- Problems that are already known to us