1. Our commitment
We welcome reports of security vulnerabilities in our systems from researchers acting in good faith. This policy explains how to report them and what you can expect from us.
2. Scope
In scope: pfundit.com and its sub-domains operated by Pfundit.
Out of scope: third-party services we use (report those to the provider); social engineering or phishing of our staff or partners; physical attacks; denial-of-service or load testing; spam or rate-limit findings without a security impact; and missing best-practice headers without a demonstrated exploit.
3. How to report
Email security@pfundit.com with a description of the issue, the affected URL or component, steps to reproduce, the likely impact, and your contact details. Please report as soon as you find the issue.
4. Rules of engagement
- Test only against your own accounts and data, and access no more data than you need to show the issue.
- Do not access, change, delete, copy or keep other people’s data. If you encounter personal data, stop, tell us, and delete any copies.
- Do not degrade the Site or disrupt anyone’s use of it.
- Do not use automated scanners at a volume that affects service.
- Keep the issue confidential until we have fixed it or agreed a disclosure date with you.
- Do not demand payment or any other benefit in exchange for your report.
5. What we will do
- Acknowledge your report within 5 business days.
- Keep you updated on our assessment and fix.
- Credit you publicly, if you wish, once the issue is fixed.
- Where you have acted in good faith and followed this policy, not bring civil action against you and not refer your research to law enforcement.
This policy cannot authorise activity that is unlawful, and it does not bind third parties. We do not currently offer monetary rewards.