Seguridad / Divulgación de vulnerabilidades (VDP)

Blast Audit (NEXT BP) welcomes responsible disclosure of security vulnerabilities.

Report a vulnerability

Send your report to security [at] blast-audit.com.

Please include:

• A clear description
• Steps to reproduce
• Affected URL(s) and/or endpoint(s)
• An impact assessment
• A proof of concept (text or link)

Do not attach the personal data or the customer data you may have accessed: describe them without reproducing them.

Scope

In scope:

• the blast-audit.com website;
• the Blast Audit web dashboard and API;
• the Blast Audit Excel add-in.

Out of scope:

• any asset not listed above, including NEXT BP's internal administration console;
• the data and accounts of other customers;
• DoS/DDoS, load testing and stress testing;
• social engineering (phishing by email or by phone), physical attacks, threats, blackmail or extortion;
• automated scanning that disrupts availability;
• issues in third-party services not controlled by Blast Audit.

Safe Harbor

We support good-faith security research. We will not file a complaint or bring a civil action against you for research that complies with all the rules below; we cannot bind the authorities or third parties.

• use only your own accounts or a test organisation;
• test only the assets in scope, without disrupting services;
• stop and notify us as soon as you access personal data or another customer's data;
• do not copy, keep or disclose any data, and delete what you obtained;
• do not escalate your privileges beyond what the proof requires;
• do not disclose anything publicly before the fix, or without our agreement;
• do not ask for any payment;
• comply with the law.

This safe harbor does not apply if any of these rules is not complied with.

Response targets

On an indicative basis, we aim for the following times:

• Acknowledgement: within 72 hours
• Initial triage: within 7 days

NEXT BP alone decides the severity of a report, the fix and its timing.

No bounty

This is a vulnerability disclosure program. We do not currently offer monetary rewards.

Scope of this policy

This policy may be changed at any time. The version online when research begins continues to cover it. This policy creates neither a contract nor a right to payment.