Vulnerability disclosure policy

How to report

Email contact@ambitsec.io with the subject line "Security". Please include:

• what you found and where (the URL or component);
• the steps to reproduce it, with any requests, screenshots or proof-of-concept code;
• the impact you think it has;
• how you would like to be credited, if at all.

Please don't include customer data in your report beyond what is needed to show the issue.

In scope

• ambitsec.io, this website;
• app.ambitsec.io, the Ambit app, and its API;
• the signed documents Ambit produces and the verification service behind /verify.

Out of scope

• systems of our customers, including anything an Ambit engagement tests;
• our providers' own platforms (report those to them);
• denial of service, load testing and spam;
• social engineering of our staff or customers, and physical attacks;
• reports from automated scanners without a demonstrated impact, and missing best practices with no security consequence.

Rules for testing

• Use only accounts you own or have permission to use, and stop as soon as you reach data that isn't yours.
• Don't degrade the service, change or delete data, or keep any data you accessed.
• Give us reasonable time to fix the issue before you disclose it publicly, and coordinate the date with us.

What you can expect from us

• We'll acknowledge your report and keep you updated while we investigate and fix it.
• We'll tell you when it is fixed, and credit you if you want to be credited.
• We won't take legal action against research that follows this policy in good faith.

This is a disclosure policy, not a paid bug bounty. Our contact details are also published in security.txt.