Vulnerability Disclosure Policy

Keeping our customers' data safe matters to us, and we welcome reports from security researchers. This policy explains how to report a vulnerability in Syzygia, what we ask of you and what you can expect from us. Our contact details are also published in machine-readable form in security.txt.

1. How to report

Email support@syzygia.io (English or Spanish) with:

• a description of the vulnerability and its potential impact;
• the steps to reproduce it, and the affected URL, component or request;
• any proof-of-concept, screenshots or logs, with other people's data removed; and
• how you would like to be credited, if at all.

Please do not report through the privacy request form, social media or public issue trackers.

2. Scope

In scope:

• the website syzygia.io and its forms;
• the Syzygia platform on syzygia.io subdomains — the Hub, the Marketplace and their APIs — using an account you are entitled to use;
• agent email addresses and other syzygia.io services we operate.

Out of scope:

• services operated by third parties, including our sub-processors and integrations (report those to the provider);
• denial-of-service or load testing, spam, and social engineering or phishing of our staff or customers;
• physical attacks on offices or data centers;
• reports without a demonstrable security impact, such as missing best-practice headers on pages without sensitive actions, or software version disclosure alone.

3. Rules of engagement

• Act in good faith and only to the extent needed to demonstrate the issue.
• Use only your own accounts or test accounts. Do not access, change, download or delete other people's data; if you come across it, stop, do not keep it, and tell us.
• Do not degrade the service, perform automated scanning at a volume that affects other users, or use any vulnerability beyond the proof of concept.
• Do not disclose the issue publicly or to others until we have fixed it or agreed a disclosure date with you.

4. What you can expect from us

• We will acknowledge your report within 5 business days and keep you informed while we investigate and fix it.
• We will agree a coordinated disclosure date with you and, if you wish, credit you when the issue is fixed.
• If a report reveals a personal data breach, we will handle it under our incident response plan and notify customers and authorities as the law and our DPA require.
• We do not currently offer a paid bug bounty program.

5. Safe harbor

If you follow this policy, we will consider your research authorized, will not pursue or support legal action against you for it, and will not report you to law enforcement. If a third party takes legal action against you for research carried out under this policy, we will make it known that your actions were authorized by us. If you are unsure whether something is allowed, ask us first at support@syzygia.io.