Bezpieczeństwo / Zgłaszanie podatności (VDP)

Jak odpowiedzialnie zgłaszać podatności bezpieczeństwa do Blast Audit.

Ostatnia aktualizacja: 28 października 2026

Wyświetlamy wersję angielską, dopóki nie przetłumaczymy tej strony.

Raport SOC 2 Type 2 wydany przez Sensiba

Sensiba wydała raport SOC 2 Type 2 dotyczący Blast Audit (systemu Software as a Service NEXT BP), obejmujący bezpieczeństwo, dostępność i poufność za okres od 1 marca 2026 do 31 maja 2026.

Raport obejmuje system Software as a Service firmy NEXT BP. Kwalifikowani klienci i potencjalni klienci mogą poprosić o pełny raport na podstawie NDA przez nasze Centrum zaufania.

Poproś o dostęp do Centrum zaufania

Certyfikat ISO 27001:2022 wydany

NEXT BP otrzymało certyfikat ISO 27001:2022 obejmujący projektowanie, rozwój, eksploatację i wsparcie Blast Audit. Certyfikat jest dostępny w naszym Centrum zaufania.

Blast Audit (NEXT BP) welcomes responsible disclosure of security vulnerabilities.

Report a vulnerability

Send your report to security [at] blast-audit.com.

Please include:

A clear description
Steps to reproduce
Affected URL(s) and/or endpoint(s)
An impact assessment
A proof of concept (text or link)

Do not attach the personal data or the customer data you may have accessed: describe them without reproducing them.

Scope

In scope:

the blast-audit.com website;
the Blast Audit web dashboard and API;
the Blast Audit Excel add-in.

Out of scope:

any asset not listed above, including NEXT BP's internal administration console;
the data and accounts of other customers;
DoS/DDoS, load testing and stress testing;
social engineering (phishing by email or by phone), physical attacks, threats, blackmail or extortion;
automated scanning that disrupts availability;
issues in third-party services not controlled by Blast Audit.

Safe Harbor

We support good-faith security research. We will not file a complaint or bring a civil action against you for research that complies with all the rules below; we cannot bind the authorities or third parties.

use only your own accounts or a test organisation;
test only the assets in scope, without disrupting services;
stop and notify us as soon as you access personal data or another customer's data;
do not copy, keep or disclose any data, and delete what you obtained;
do not escalate your privileges beyond what the proof requires;
do not disclose anything publicly before the fix, or without our agreement;
do not ask for any payment;
comply with the law.

This safe harbor does not apply if any of these rules is not complied with.

Response targets

On an indicative basis, we aim for the following times:

Acknowledgement: within 72 hours
Initial triage: within 7 days

NEXT BP alone decides the severity of a report, the fix and its timing.

No bounty

This is a vulnerability disclosure program. We do not currently offer monetary rewards.

Scope of this policy

This policy may be changed at any time. The version online when research begins continues to cover it. This policy creates neither a contract nor a right to payment.