Sicurezza / Divulgazione vulnerabilità (VDP)

Come segnalare in modo responsabile vulnerabilità di sicurezza a Blast Audit.

Ultimo aggiornamento: 28 ottobre 2026

Mostriamo la versione inglese finché la traduzione non è pronta.

Report SOC 2 Type 2 rilasciato da Sensiba

Sensiba ha rilasciato un report SOC 2 Type 2 su Blast Audit (il sistema Software as a Service di NEXT BP), che copre Sicurezza, Disponibilità e Riservatezza per il periodo dal 1° marzo 2026 al 31 maggio 2026.

Il report copre il Software as a Service System di NEXT BP. Clienti e prospect qualificati possono richiedere il report completo sotto NDA tramite il nostro Trust Center.

Richiedi accesso al Trust Center

Certificato ISO 27001:2022 rilasciato

NEXT BP ha ricevuto un certificato ISO 27001:2022 che copre progettazione, sviluppo, operazioni e supporto di Blast Audit. Il certificato è disponibile tramite il nostro Trust Center.

Blast Audit (NEXT BP) welcomes responsible disclosure of security vulnerabilities.

Report a vulnerability

Send your report to security [at] blast-audit.com.

Please include:

A clear description
Steps to reproduce
Affected URL(s) and/or endpoint(s)
An impact assessment
A proof of concept (text or link)

Do not attach the personal data or the customer data you may have accessed: describe them without reproducing them.

Scope

In scope:

the blast-audit.com website;
the Blast Audit web dashboard and API;
the Blast Audit Excel add-in.

Out of scope:

any asset not listed above, including NEXT BP's internal administration console;
the data and accounts of other customers;
DoS/DDoS, load testing and stress testing;
social engineering (phishing by email or by phone), physical attacks, threats, blackmail or extortion;
automated scanning that disrupts availability;
issues in third-party services not controlled by Blast Audit.

Safe Harbor

We support good-faith security research. We will not file a complaint or bring a civil action against you for research that complies with all the rules below; we cannot bind the authorities or third parties.

use only your own accounts or a test organisation;
test only the assets in scope, without disrupting services;
stop and notify us as soon as you access personal data or another customer's data;
do not copy, keep or disclose any data, and delete what you obtained;
do not escalate your privileges beyond what the proof requires;
do not disclose anything publicly before the fix, or without our agreement;
do not ask for any payment;
comply with the law.

This safe harbor does not apply if any of these rules is not complied with.

Response targets

On an indicative basis, we aim for the following times:

Acknowledgement: within 72 hours
Initial triage: within 7 days

NEXT BP alone decides the severity of a report, the fix and its timing.

No bounty

This is a vulnerability disclosure program. We do not currently offer monetary rewards.

Scope of this policy

This policy may be changed at any time. The version online when research begins continues to cover it. This policy creates neither a contract nor a right to payment.