Our commitment
The security of our users' data comes first. If you have found a vulnerability in Vukassa, we want to hear about it, fix it quickly and keep you informed at every step.
This policy sets out what is covered, how to report, what we expect from good-faith research and what we commit to in return. It supplements the terms of use: for research carried out within its scope, this policy applies.
Scope
The following are covered:
- the Vukassa apps for iPhone and Android, in the versions distributed through the App Store and Google Play;
- the API those apps connect to;
- the vukassa.com website and the subdomains of vukassa.com operated by Vukassa.
If you are unsure about an asset, write to us before testing it: we will answer.
Out of scope
The following are not covered, and must not be tested under this policy:
- the third-party services we use (hosting, authentication, email delivery, the Apple and Google stores) — a vulnerability on their side is reported to them, under their own program;
- denial-of-service attacks, load testing and any high-volume automated testing;
- social engineering, phishing and any approach targeting the Vukassa team, its providers or its users;
- physical access to a device or to premises.
The following are not treated as vulnerabilities unless an impact on the security of data or accounts is demonstrated: unverified reports from automated tools, a missing header or best practice without an exploitation scenario, issues that only affect the person who triggers them (self-XSS), issues that require a jailbroken or rooted device, or an already unlocked device in the attacker's hands, and issues that only affect browsers or systems that no longer receive security updates.
Rules for good-faith research
To stay within this policy:
- only use your own accounts, or test accounts you have created;
- do not access, modify or delete other people's data — if you come across data that is not yours, stop, do not keep it and let us know;
- do not go further than needed to demonstrate the vulnerability;
- do not degrade the service or disrupt other users;
- keep the vulnerability confidential until it is fixed, or until the publication date agreed with us;
- do not ask for anything in return for the report.
How to report
Write to privacy@vukassa.com, in English or French. So that we can reproduce the vulnerability quickly, please include where possible:
- a description of the vulnerability and its impact;
- the steps to reproduce it, with the address, screen or call involved;
- the platform and app version, or the browser used;
- a proof (screenshot, request, code excerpt), without other people's data.
If your report contains sensitive information, first send a message without the details: we will agree together on a suitable way to exchange. Do not send executable files.
You can also send your report to ANSSI, the French national cybersecurity agency, which keeps confidential the identity of anyone who reports a vulnerability to it in good faith (article L. 2321-4 of the French Defense Code).
Our timelines
- Acknowledgment — within 72 business hours;
- Initial assessment — within 10 business days: we tell you whether the vulnerability is confirmed and the severity we assign to it;
- Fix — our target is 7 days for a critical vulnerability, 30 days for a high-severity one and 90 days for the others;
- Follow-up — we keep you informed of progress, and we tell you, with the reason, if a timeline cannot be met.
A fix to the apps only takes effect once the new version has been approved by Apple and Google; when the severity justifies it, we then make the update mandatory.
We prefer coordinated disclosure: once the vulnerability is fixed, you are free to publish it, and we agree on the date together. Failing agreement, publication is possible 90 days after your report.
Our commitment to good-faith researchers
If your research complies with this policy, we consider it authorized. We commit to:
- bring no legal action, civil or criminal, and file no complaint against you in connection with that research;
- not hold against you the restrictions of the terms of use — decompiling, circumventing limits, security testing — to the extent needed for that research;
- make it known, if a third party takes action against you over compliant research, that it was authorized by us.
This commitment only binds Vukassa: it cannot authorise research on behalf of a third party, or on a service that is out of scope. If you are unsure whether a test complies, ask us before running it.
Acknowledgments
There is no financial reward (bug bounty) at this stage. With your consent, we thank you publicly on this page, under the name or pseudonym of your choice, once the vulnerability is fixed.
No report has been published here yet.
Changes to this policy
This policy may change; the date at the top of the page shows its last update. A report is handled under the version in force on the day we receive it. The policy is authoritative in English and French.