Security Vulnerability Reporting Policy

Kubu Smart Ltd takes security issues extremely seriously and welcomes feedback from security researchers in order to improve the security of its services. We operate a policy of coordinated disclosure for dealing with reports of security vulnerabilities and issues.

This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to us. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always act in compliance with it.

To privately report a suspected security issue to us, please use the form below, or send an email to security-alert@getkubu.com.

In your report, please include:

Vulnerability Details:

• Asset (web address, IP Address, product or service name) where the vulnerability can be observed
• Weakness (e.g. CWE) (optional)
• Severity (e.g. CVSS v3.0) (optional)
• Title of vulnerability (mandatory)
• Description of vulnerability (mandatory)
  (This should include a summary, supporting files and possible mitigations or recommendations) (mandatory)
• Impact (what could an attacker do?)
• Steps to reproduce.
  These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities, such as sub-domain takeovers

Optional Contact Details:

• Name
• Email Address

After you have submitted your report, we will respond to your report within 5 working days and aim to triage your report within 10 working days. We will also aim to keep you informed of our progress.

Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 14 days. This allows our teams to focus on the remediation.

We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.

Once your vulnerability has been resolved, we welcome requests to disclose your report. We would like to unify guidance to affected users, so please do continue to coordinate public release with us.

We value those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures.

Process

1. All notifications received will be responded to within five working days, acknowledging receipt of your message. The acknowledgement will be sent to the initiator’s email address.
2. We will then investigate your concern and send a response to the initiator’s email address within ten working days of receipt of your concern.
3. If we feel no further action is required, we will state that in our response and provide a reason for our decision.
4. If we feel further action is required, we will provide weekly updates to the initiator’s email address until the issue is resolved.

Acceptable Research

Whilst we encourage investigation of potential security vulnerabilities, we cannot condone any activities which might interfere with legitimate users or which might contravene applicable computer misuse and data protection legislation. For that reason, the following activities are prohibited:

• Modification or destruction of data
• Interruption or degradation of services, for example Denial of Service attacks
• Disclosure of personal, proprietary or financial information

Thank You

Credit to the people who have helped make our services more secure by making a coordinated disclosure with us will appear here with consent.

Document Change History