1What this covers
We welcome reports of security problems in what we publish under the NxSCORE name:
- this website;
- the NxSCORE platform and its sign-in;
- the NxSCORE scanner, and the roles and templates customers deploy to connect it.
Out of scope: our customers' cloud accounts, third-party services we use or link to, and reports that rely on social engineering or physical access.
2How to report
Email security@esecforte.com with "Security report" in the subject. Please include:
- what is affected (the page, endpoint, template or version);
- the steps to reproduce it, and what you saw;
- the impact you believe it has;
- how you would like to be credited, if at all.
For an active attack on your own organisation, write to incidents@esecforte.com instead.
3Please keep to these rules
- Test only against accounts and data that are yours.
- If you reach anyone else's data, stop, do not keep or share it, and tell us what you saw.
- Do not run denial-of-service or volume tests, or anything that degrades the service.
- Do not change or delete data, or leave anything running behind you.
- Give us reasonable time to fix the problem before you share it, normally 90 days.
4What we do in return
- Acknowledge your report within 3 working days.
- Tell you whether we can reproduce it, and keep you updated until it is fixed.
- Agree the timing of any public disclosure with you.
- Credit you when it is published, if you want that.
- Not take legal action against research done in good faith within these rules, and say so if anyone asks.
5Rewards
We do not run a paid bug bounty. Our own researchers report problems they find in other vendors' products the same way, and we hold ourselves to the same process.