Vulnerability Disclosure Policy

If you have found a security problem in FleetProxy, we want to hear about it before anyone else does. This page tells you where to send it and what we will do.

1. How to report

Email support@fleetproxy.io with “Security” at the start of the subject line. Useful reports include:

• What the issue is and where you found it, with the exact URL or endpoint.
• The steps to reproduce it, in enough detail that we can follow them.
• What an attacker could actually do with it.
• Any proof of concept, logs or screenshots you are willing to share.

Please report in English, and please report to us first rather than publishing.

2. What we promise you

• We will acknowledge your report and tell you whether we can reproduce it.
• We will keep you updated while we work on a fix, and tell you when it is deployed.
• We will not pursue legal action against you for research carried out in good faith and within this policy, and we will not ask your internet provider or employer to act against you for it.
• We are happy to credit you publicly once the issue is fixed, if you want that.

3. Rewards

We do not run a fixed bounty programme with published amounts. Reports that identify a real and meaningful issue may be rewarded at our discretion, decided case by case on the severity and the quality of the report. We will not promise you a figure in advance, and you should report because the issue matters rather than because of what it might pay.

4. What we ask of you

• Give us reasonable time to fix the issue before you discuss it publicly.
• Do not access, modify or delete data belonging to anyone else. If you come across customer data, stop and tell us.
• Do not degrade the service for other people. That rules out denial of service testing, automated scanning at volume, and spam.
• Do not use social engineering, phishing or physical access against our staff, our customers or our suppliers.
• Test only against your own account and your own data.

5. Out of scope

The following are not usually treated as vulnerabilities:

• Missing security headers or cookie flags with no demonstrated impact.
• Output from an automated scanner without a working proof of concept.
• Reports about software versions, with no exploit shown against our systems.
• Issues that require a device or an account to already be compromised.
• Findings on third-party services we use rather than on our own systems. Report those to the provider.

Behaviour of the proxy network itself is not a vulnerability. What the network may be used for is covered by our Acceptable Use Policy, and abuse coming from the network should be reported the way that page describes.

6. Changes to this policy

We update this page as our process changes. The date at the top tells you when it last did.