Vulnerability Disclosure Policy
Forensic Analytics Limited welcomes the responsible reporting of suspected security vulnerabilities. This policy explains how security researchers, customers and other parties can report concerns confidentially, what information to provide, the activities that are authorised, and what reporters can expect from us.
Scope
This policy applies to software products, hosted services, websites, APIs and other internet-facing systems owned or operated by Forensic Analytics Limited.
How to report a vulnerability
Please report suspected vulnerabilities as soon as reasonably possible by sending us an email to [email protected]. Do not include sensitive customer, case or evidential data in an initial report.
Information to include
Your name or preferred identifier and a safe way to contact you. Anonymous reports are accepted but may limit our ability to investigate or provide updates.
The affected product, service, version, domain, URL or endpoint.
A clear description of the vulnerability and its potential impact.
Reproduction steps, proof-of-concept material and relevant screenshots or logs.
The date and time of testing, including your time zone.
Any data that may have been accessed and the steps you took to minimise exposure.
Whether you have shared, or intend to share, the issue with any other party.
Responsible research guidelines
To support safe and constructive testing, we ask that you:
Act in good faith and only test systems that are in scope.
Stop testing and notify us immediately if you encounter personal data, customer data, evidential material, credentials or other confidential information.
Use the minimum access and actions required to confirm the vulnerability.
Do not exploit a vulnerability beyond what is necessary to demonstrate it.
Do not disrupt services, alter data, establish persistence, move laterally, exfiltrate information or access other users’ accounts.
Do not use social engineering, phishing, physical intrusion or denial-of-service techniques.
Keep vulnerability details confidential until we have completed remediation or agreed a coordinated disclosure date with you.
Delete any Forensic Analytics data obtained unintentionally once we confirm it is no longer required for investigation.
Comply with applicable law.
What you can expect from us
When a report is made in accordance with this policy, Forensic Analytics will:
Acknowledge receipt of the report.
Provide a reference number and a contact for follow-up where practicable.
Validate and triage the report, considering exploitability, impact, affected customers and available mitigations.
Keep you informed at reasonable intervals where you have provided contact details.
Handle your identity and report details on a need-to-know basis, subject to legal, regulatory and customer-notification obligations.
Coordinate remediation, customer communications and disclosure with relevant parties where appropriate.
Notify you when the issue has been resolved or otherwise closed, where practicable.
Safe Harbour
If you act in good faith, comply with this policy and avoid harm, Forensic Analytics will not seek to initiate legal action against you solely for your security research. If a third-party initiates legal action arising from compliant research, we may confirm that your activity was conducted in accordance with this policy. This statement does not authorise unlawful activity, bind third parties, waive any rights, or prevent us from acting where testing is reckless, harmful, extortive or outside this policy.
Disclosure and publication
Do not publicly disclose a suspected vulnerability before Forensic Analytics has had a reasonable opportunity to investigate and remediate it.
We will seek to agree a coordinated disclosure date with the reporter, taking account of risk, fix availability, customer deployment and public interest.
Forensic Analytics may notify customers, regulators, law enforcement, suppliers or other affected parties where appropriate or required.
Public recognition or attribution may be offered with the reporter’s consent. Forensic Analytics does not currently operate a bug bounty programme and does not promise payment or reward.
Our internal handling process
Stage | Action | Required record |
Record and protect | Log the report in the approved vulnerability tracking system, restrict access and preserve relevant evidence. | Report record and evidence |
Validate and triage | Confirm scope and reproducibility, assess severity and impact, and identify affected products, versions and customers. | Severity, impact and ownership decision |
Contain and remediate | Apply proportionate mitigations, develop and test fixes, and manage release through the approved secure development and change processes. | Mitigation, fix and test evidence |
Communicate | Inform internal security stakeholders and affected customers or other relevant parties where appropriate. | Notification and disclosure decisions |
Close and learn | Confirm remediation, retain an audit trail, document lessons learned and update controls, tests or threat models as necessary. | Closure approval and lessons learned |
Data protection and confidentiality
Personal information submitted with a report will be used to receive, investigate and respond to the vulnerability report, manage remediation, maintain security records and meet legal or regulatory obligations. Reporters should provide only the information necessary for these purposes. For details of how Forensic Analytics handles personal data, refer to Data Privacy Declaration | Forensic Analytics and Data Privacy Policy | Forensic Analytics.
Policy ownership, review and contact
The Chief Risk & Compliance Officer, supported by the Information Security Forum and relevant product technical leads, owns this policy. It will be reviewed at least annually and after a material vulnerability, incident, legal change or significant change to the reporting process.
Vulnerability reports or questions about this policy should be sent to [email protected]
Qualio POL-93 V1.0