Responsible Disclosure Policy
At Clean Networks we take the security of our systems seriously. Despite the care we put into securing them, a weakness may still exist.
If you have found a weakness in one of our systems, we would like to hear about it so we can take measures as quickly as possible. We would like to work with you to better protect our users and our systems.
We ask you to:
- Email your findings to bureau@cleannetworks.net. Encrypt your findings with our PGP key to prevent the information from falling into the wrong hands,
- Not abuse the problem, for example by downloading more data than necessary to demonstrate the leak, or by viewing, deleting or modifying third-party data,
- Not share the problem with others until it has been resolved, and delete all confidential data obtained through the leak immediately after it has been closed,
- Not use attacks on physical security, social engineering, distributed denial of service, spam or third-party applications, and
- Provide enough information to reproduce the problem so we can resolve it as quickly as possible.
What we promise:
- We will respond to your report within 5 days with our assessment and an expected date for a solution,
- If you have complied with the conditions above, we will not take legal action against you regarding the report,
- We will treat your report confidentially and will not share your personal data with third parties without your consent, unless required to comply with a legal obligation. Reporting under a pseudonym is possible,
- We will keep you informed of the progress in resolving the problem,
- In communications about the reported problem we will, if you wish, credit you as the discoverer and/or include you in the Hall of Fame.
We aim to resolve all problems as quickly as possible, and we would like to be involved in any publication about the problem after it has been resolved.
This document is based on the work of Floor Terra.
