Vulnerability Disclosure Policy

01Introduction

1.1.Duckurity welcomes reports of security vulnerabilities in our systems from the research community. This policy sets out how to report a vulnerability, which systems are in scope, the rules that apply to testing, and the commitments we make to researchers who follow it. Capitalized terms not defined in this policy have the meanings given in our Terms of Service.

1.2.Testing of training Labs within the Academy is governed by our Acceptable Use Policy. This policy applies to all other systems.

02Reporting a Vulnerability

2.1.Please send reports to security@duckurity.com and include:

• (a)a description of the vulnerability and the affected system;
• (b)the steps required to reproduce it;
• (c)its potential impact; and
• (d)the name or Handle under which you wish to be acknowledged, if any.

2.2.We will acknowledge your report within 3 working days, provide an initial assessment within 10 working days, and notify you when the vulnerability has been resolved.

03Scope

3.1.The following are in scope:

• (a)academy.duckurity.com, including its sign-in system and API;
• (b)duckurity.com;
• (c)any means of escaping a Lab Session, including access from within a Session to another user's Session, to the infrastructure running Labs, to the Academy application, or to the internet; and
• (d)our email sending, including spoofing of email from our domains.

3.2.The following are out of scope:

• (a)vulnerabilities contained in Labs by design;
• (b)systems operated by the service providers listed on our Subprocessors page, which should be reported to the relevant provider;
• (c)denial-of-service attacks, load testing and spam;
• (d)social engineering of our staff or users, and physical attacks;
• (e)findings with no demonstrable security impact, such as missing security headers in isolation, disclosure of software versions, or unverified output from automated scanners; and
• (f)clickjacking on pages without sensitive actions, and logout cross-site request forgery.

04Rules of Engagement

4.1.When conducting research, you must:

• (a)use only accounts that you have created;
• (b)not access, modify or delete data belonging to others. If you encounter such data, you must stop, retain only the minimum necessary to demonstrate the issue, and report it to us;
• (c)not degrade the Service for other users;
• (d)delete any data obtained during your research once your report has been submitted; and
• (e)allow us 90 days to resolve the vulnerability before any public disclosure, unless we agree otherwise. If we need more time, we will tell you why.

05Safe Harbor

5.1.If you act in good faith and in accordance with this policy, we will consider your research to be authorized. We will not initiate legal action against you or report you to law enforcement in connection with that research, including under Egypt's Anti-Cyber and Information Technology Crimes Law, Law No. 175 of 2018, or equivalent laws elsewhere. If a third party initiates legal action against you in connection with research conducted in accordance with this policy, we will make it known that your research was authorized.

5.2.This safe harbor applies only to systems operated by Duckurity. We cannot authorize testing of systems operated by third parties.

06Recognition

6.1.We do not currently operate a paid bug bounty programme. With your permission, we will acknowledge your contribution publicly.

07Contact

Security reports and questions about this policy may be sent to security@duckurity.com.