Vulnerability Disclosure Policy

Security researchers help keep our customers safe, and we welcome their work. If you believe you have found a security issue in an ABYSSS product or digital asset, please email contact@abysss.io with “Security report” in the subject line.

A useful report includes:

• The product, URL or asset affected.
• Clear steps to reproduce the issue, with a proof of concept if you have one.
• The impact you believe it has.
• How we can reach you, and the name you would like credited, if any.

This policy covers products and digital assets owned and operated by ABYSSS:

• The abysss.io website and its subdomains.
• The products listed on our Tools page.
• Public code repositories in the abysss-io GitHub organisation.

The following are not in scope:

• Services run by other companies, even when we use them. Please report those to the provider.
• Missing headers or best-practice settings with no demonstrated security impact.
• Reports generated by automated tools that have not been verified.
• Self-XSS, or issues that only work in unsupported browsers.
• Clickjacking on pages with no sensitive actions.

• Test only against accounts and data that you own or have permission to use.
• Stop as soon as you have shown the issue. If you reach data that is not yours, do not copy, change or keep it, and tell us in your report.
• Do not run denial of service tests or high-volume automated scans, and do not send bulk messages through our forms.
• Do not use social engineering, phishing or physical intrusion against our people, offices or customers.
• Give us reasonable time to fix the issue before sharing it with anyone else.
• Do not ask for payment in exchange for withholding or releasing a finding.

When you report an issue in line with this policy, we will:

• Acknowledge your report within 5 business days.
• Tell you whether we could confirm the issue, and keep you updated as we work on it.
• Let you know when it is fixed, and agree any public disclosure with you.
• Credit you publicly if you would like us to.

We do not currently offer payment for reports.

We will not take legal action against you, or report you to law enforcement, for research carried out in good faith and in line with this policy. If someone else brings a claim over that research, we will make it known that you acted within this policy. This commitment covers ABYSSS only and cannot bind other companies or authorities.