Security & Responsible Disclosure

Security is central to the work we do for our clients, and we take the security of our own systems just as seriously. If you believe you have found a security vulnerability in a Fintrix website or system, we want to hear from you. This policy explains how to report it, what to expect from us and how we will treat you.

How to report a vulnerability

Email security@fintrix.so. Our machine-readable security contact details are also published at /.well-known/security.txt, following RFC 9116.

To help us understand and fix the issue quickly, please include:

a description of the vulnerability and the impact you believe it has;
the affected URL, system or component;
clear steps to reproduce the issue, including any proof-of-concept code, requests or screenshots;
your name or handle, if you would like to be credited, and how we can contact you.

Please write in English if you can. If you need to share sensitive details in encrypted form, say so in your first email and we will arrange a secure channel. Please do not report vulnerabilities through the website contact form, social media or other public channels.

In scope

This policy covers systems that Fintrix owns and operates, including:

fintrix.so and www.fintrix.so;
other subdomains of fintrix.so that are operated by Fintrix;
email security configuration for the fintrix.so domain, where you can show a practical impact (for example, a demonstrated ability to spoof our email).

If you are not sure whether something is in scope, email us before you start testing.

Out of scope

Our clients' systems. Applications and infrastructure that we build or operate for clients belong to those clients and are not covered by this policy, even if Fintrix is named on them. Do not test them under this policy. If you find a vulnerability in a client's system, please report it to that organisation through its own disclosure channel. If you cannot find one, contact us and we will help pass it on.

Third-party services. Services we use but do not operate, such as our hosting provider, form processor and email provider, are out of scope. Please report issues in them directly to the provider concerned.

Types of finding. These generally do not qualify unless you can show a real, practical security impact:

reports generated only by automated scanners, without verification;
missing security headers, cookie flags or best-practice settings, on their own;
clickjacking on pages with no sensitive actions;
SPF, DKIM or DMARC recommendations without a demonstrated spoofing risk;
TLS or cipher configuration reports without a practical exploit;
disclosure of software versions or banners;
content spoofing or text injection without a way to execute code or mislead users in a harmful way;
self-XSS, or issues that require an unlikely level of user interaction;
missing rate limits on forms, or spam sent through the contact or newsletter forms;
vulnerabilities that only affect outdated or unsupported browsers;
broken links, or the takeover of social media accounts or domains that we do not own.

Rules of engagement

When researching vulnerabilities, please:

test only against systems in scope, and only to the extent needed to confirm a vulnerability;
avoid privacy violations, data destruction and any interruption or degradation of our services;
not access, change, download or keep data that does not belong to you. If you come across personal or confidential data, stop, do not share it, and tell us straight away;
not run denial-of-service attacks, heavy automated scanning or brute-force attacks;
not use social engineering, phishing or physical attacks against our people, offices or clients;
not plant backdoors or persistent access, or move into other systems after you have confirmed an issue;
give us a reasonable amount of time to fix the issue before you disclose it publicly (see Coordinated disclosure);
comply with all applicable laws.

Safe harbour

If you make a good-faith effort to follow this policy while researching and reporting a vulnerability, we will consider your research to be authorised. Specifically, we:

will not take legal action against you, or ask law enforcement to investigate you, for that research;
will not bring a claim against you for circumventing technical measures we use to protect the systems in scope, where that was needed for your research;
consider your research to be an exempted use of our systems under our Terms of Use, to the extent those terms would otherwise prohibit it.

If a third party brings legal action against you for research you carried out in line with this policy, we will make it known that your actions were authorised by us.

This safe harbour applies only to systems in scope that Fintrix owns and operates. We cannot authorise testing of systems that belong to our clients or service providers. If you are unsure whether your research is consistent with this policy, please contact us before going further.

What to expect from us

When you report a vulnerability in line with this policy, we will:

acknowledge your report within 3 working days;
give you an initial assessment, including whether we have been able to confirm the issue and how severe we believe it is, within 10 working days;
keep you updated on our progress at least every 14 days until the issue is resolved;
aim to fix confirmed vulnerabilities within 90 days, and sooner for critical issues;
tell you when the issue has been fixed;
with your permission, credit you publicly once the issue is resolved.

We will treat your report and your contact details as confidential and will not share them outside Fintrix without your permission, except where we need to pass on a report to a client or service provider whose system is affected.

Coordinated disclosure

We ask you not to share details of a vulnerability publicly until it has been fixed, or until 90 days after your report, whichever comes first. If we need longer to fix a complex issue, we will explain why and agree a new timeline with you. We would like to coordinate any public disclosure with you, so that users are protected before the details become known.

No bug bounty

We do not run a bug bounty programme and do not offer payment or other rewards for vulnerability reports. Please do not make your report, or its disclosure, conditional on payment. We are very grateful for responsible reports, and we are happy to credit researchers publicly with their permission.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top of the page shows when we last changed it. The version published when you carry out your research is the one that applies.