Security / Vulnerability Disclosure (VDP)

How to responsibly report security vulnerabilities to Blast Audit.

Last updated: October 28, 2026

SOC 2 Type 2 report issued by Sensiba

Sensiba issued a SOC 2 Type 2 report on Blast Audit (NEXT BP’s Software as a Service system), covering Security, Availability, and Confidentiality for the period March 1, 2026 to May 31, 2026.

The report covers NEXT BP's Software as a Service System. Qualified customers and prospects can request the full report under NDA through our Trust Center.

Request Trust Center access

ISO 27001:2022 certificate issued

NEXT BP has been issued an ISO 27001:2022 certificate covering the design, development, operations, and support of Blast Audit. The certificate is available through our Trust Center.

Blast Audit (NEXT BP) welcomes responsible disclosure of security vulnerabilities.

Report a vulnerability

Send your report to security [at] blast-audit.com.

Please include:

A clear description
Steps to reproduce
Affected URL(s) and/or endpoint(s)
An impact assessment
A proof of concept (text or link)

Do not attach the personal data or the customer data you may have accessed: describe them without reproducing them.

Scope

In scope:

the blast-audit.com website;
the Blast Audit web dashboard and API;
the Blast Audit Excel add-in.

Out of scope:

any asset not listed above, including NEXT BP's internal administration console;
the data and accounts of other customers;
DoS/DDoS, load testing and stress testing;
social engineering (phishing by email or by phone), physical attacks, threats, blackmail or extortion;
automated scanning that disrupts availability;
issues in third-party services not controlled by Blast Audit.

Safe Harbor

We support good-faith security research. We will not file a complaint or bring a civil action against you for research that complies with all the rules below; we cannot bind the authorities or third parties.

use only your own accounts or a test organisation;
test only the assets in scope, without disrupting services;
stop and notify us as soon as you access personal data or another customer's data;
do not copy, keep or disclose any data, and delete what you obtained;
do not escalate your privileges beyond what the proof requires;
do not disclose anything publicly before the fix, or without our agreement;
do not ask for any payment;
comply with the law.

This safe harbor does not apply if any of these rules is not complied with.

Response targets

On an indicative basis, we aim for the following times:

Acknowledgement: within 72 hours
Initial triage: within 7 days

NEXT BP alone decides the severity of a report, the fix and its timing.

No bounty

This is a vulnerability disclosure program. We do not currently offer monetary rewards.

Scope of this policy

This policy may be changed at any time. The version online when research begins continues to cover it. This policy creates neither a contract nor a right to payment.