Responsible Vulnerability Disclosure Program

Responsible Vulnerability Disclosure Policy

Introduction

1. Scope

• Physical attacks against HappySignals employees, offices, or data centers.
• Social engineering (e.g., phishing, vishing, smishing) of HappySignals employees or contractors.
• Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attacks.
• Attacks on third-party services or products not directly controlled by HappySignals (unless the vulnerability directly impacts our services via a misconfiguration or specific integration).
• Attacks against services or systems clearly marked as “internal,” “stage,” “dev,” or “test.”
• Vulnerabilities in outdated browser versions or plugins.
• Missing security best practices that do not directly lead to an exploitable vulnerability (e.g., missing HTTP security headers that do not allow for content injection).
• Descriptive error messages or banner disclosures that do not provide direct access to sensitive data or a direct attack vector.
• Self-XSS (Cross-Site Scripting that requires the user to paste the payload into their own browser console).
• Issues related to user enumeration through brute-forcing login pages or “Forgot Password” functionality that are sufficiently rate-limited.
• Publicly accessible information that does not pose a security risk.
• Vulnerabilities that require complex or unlikely user interaction to exploit.

2. How to Report a Vulnerability 

• Clear description of the vulnerability: What is the vulnerability, and what is its potential impact?
• Steps to reproduce: Detailed, step-by-step instructions on how to replicate the vulnerability.
• Proof-of-concept (PoC): If applicable, a working example or code snippet demonstrating the vulnerability.
• Affected assets/URLs: Specific URLs, endpoints, or system components that are vulnerable.
• Screenshots or video: Visual evidence of the vulnerability (if applicable).

3. Our Commitment

• Acknowledgement: We will acknowledge receipt of your report within 4 business days.
• Investigation: Our security team will investigate your report promptly and thoroughly.
• Communication: We will keep you updated on the status of your report, including any questions we may have or requests for further information.
• Remediation: We will work diligently to validate and remediate confirmed vulnerabilities. The time to resolve will depend on the complexity and severity of the issue.
• Transparency (with discretion): We will collaborate with you on public disclosure, if desired, after the vulnerability has been fixed. We prefer to remediate the issue before any public disclosure.
• No Legal Action: We will not pursue legal action against individuals who discover and report vulnerabilities in good faith, in compliance with this policy, and without causing disruption or harm.

4. Guidelines for Responsible Disclosure

• Act in Good Faith: Conduct your research ethically and responsibly.
• Do Not Disclose Publicly Without Permission: Do not disclose any information about the vulnerability to the public or to any third party until we have acknowledged the report, investigated it, fixed the issue, and mutually agreed upon a disclosure plan (if any).
• Do Not Interrupt Our Services: Avoid any testing or activities that could disrupt our services, compromise data integrity, or impact user experience.
• Do Not Access or Modify Data: Do not access, modify, delete, or store any user data without explicit permission. Only access enough data to prove the vulnerability.
• Avoid Privacy Violations: Do not attempt to access or exploit personal user accounts or data.
• Comply with Laws: Adhere to all applicable laws and regulations.

5. Legal Disclaimer