We welcome reports from security researchers and anyone else who finds a weakness in Cyprus Connect. This policy explains how to report it and what you can expect from us. It follows the principles of coordinated vulnerability disclosure promoted by ENISA and the Cyber Resilience Act.
1. How to report
Email security@cyprusconnect.net with:
- a description of the weakness and where it is (URL, feature);
- the steps to reproduce it, and a proof of concept if you have one;
- its possible impact;
- how we can contact you, and whether you would like to be credited.
Our contact details are also published at /.well-known/security.txt.
2. Scope
In scope: cyprusconnect.net and its subdomains (vault, screening, gdpr, host) and the software that runs them. Out of scope: third-party services we link to, including the external hosting portal; social engineering of our staff or customers; physical attacks; denial-of-service testing; and reports from automated scanners without a demonstrated impact.
3. Rules for testing
- Use only your own test accounts. Do not access, change or delete data that is not yours.
- If you reach customer data by accident, stop immediately, do not keep or share it, and tell us.
- Do not degrade the service: no denial-of-service, brute force, spam or large-scale automated testing.
- Give us a reasonable time to fix the issue before you disclose it publicly. We suggest 90 days, or sooner once a fix is released.
4. Our commitments
- We acknowledge your report within 3 working days.
- We give you an initial assessment within 10 working days and keep you informed until it is fixed.
- We aim to fix critical issues within 7 days and other issues as quickly as their risk requires.
- We credit you publicly if you wish, once the issue is fixed.
- If a vulnerability is actively exploited or affects other organisations, we report it to the competent authorities (the national CSIRT of Cyprus, CSIRT-CY) where appropriate.
5. Safe harbour
If you act in good faith and follow this policy, we will consider your research authorised, we will not take legal action against you for it, and we will support you if a third party does. This does not cover actions that harm our customers, their data or the availability of the Services.
6. Rewards
We do not currently run a paid bug bounty programme, but we are grateful for every responsible report.
Topify Consulting Ltd, registration no. HE 409159, VAT no. 10409159B, Alkyonis 1, 3087 Limassol, Cyprus. Contact: info@cyprusconnect.net. If a translation of this document differs from the English version, the English version applies.