Vulnerability Disclosure Policy

01Reporting a vulnerability

This policy covers the ProveCONSULT website and application at proveconsult.com and www.proveconsult.com. We welcome reports from anyone: users, clients and independent researchers.

The same details are in our security.txt file.

02What to include

• The page, feature or address affected.
• What the weakness is and what someone could do with it.
• The steps to reproduce it, and any screenshots or requests that help.
• How we can contact you, and whether you would like to be thanked by name once it is fixed.

03What we promise

• We will acknowledge your report within 2 business days.
• We will look into it, tell you what we found, and keep you updated while we fix it.
• We will tell you when it is fixed, and agree with you when it can be talked about publicly.

04Rules for testing

• Don’t access, change, copy or delete anyone else’s data. If you come across data that is not yours, stop, don’t keep a copy, and tell us.
• Use only accounts you own or have permission to use, and test only within your own organisation.
• Do only what you need to show the problem exists.
• Don’t disrupt the service for other people or slow it down.
• Give us a reasonable time to fix the problem before you share it with anyone else.

05Out of scope

• Denial-of-service attacks, load testing and spam.
• Social engineering or phishing of our staff, our clients or their stakeholders.
• Physical attacks on our offices, equipment or people.
• The services of other companies we use (for example, hosting, email and sign-in providers). Please report those to the company concerned.
• Reports from automated scanners with no evidence of a real weakness.