Purpose
Mazel Grand HMS values the work of security researchers and the role they play in keeping the internet safe. This Responsible Disclosure Policy outlines how we handle security vulnerability reports and our commitments to researchers who report issues to us in good faith.
We believe in responsible disclosure: working together to identify and fix security issues before they can be exploited by malicious actors.
What is in scope
We welcome reports about security vulnerabilities in the following systems:
- Our public website: www.mazelgrandhms.com and all pages under this domain.
- Our web application: the customer-facing application used for service delivery.
- Our authentication systems: login, password reset, and session management mechanisms.
- Our API endpoints: any public or authenticated API we expose.
- Third-party services integrated into our systems: if you find a vulnerability in how we use a third-party service, we want to know.
What is out of scope
The following activities are explicitly out of scope and we do not authorise testing in these areas:
- Denial-of-service attacks: any activity that degrades or disrupts service availability.
- Social engineering: attempts to trick our employees or customers into revealing information.
- Physical security: testing of physical access controls or facilities.
- Third-party services: vulnerabilities in third-party services we use should be reported directly to those vendors.
- Client data: any attempt to access, exfiltrate, or analyse data belonging to our clients is strictly prohibited.
- Spam or phishing: sending unsolicited messages to our employees or customers.
- Client environments: testing of client systems or networks without explicit authorisation.
How to report a vulnerability
If you discover a security vulnerability, please report it to us following these guidelines:
- Email: send your report to info@mazelgrandhms.com with "Security report" in the subject line.
- Description: provide a clear description of the vulnerability, including where it exists and how it could be exploited.
- Reproduction steps: include detailed steps to reproduce the issue, if possible.
- Impact assessment: explain the potential impact of the vulnerability and who might be affected.
- Proof of concept: include screenshots, videos, or code that demonstrates the vulnerability (without exploiting it against real data).
- Contact information: provide a way for us to contact you if we need clarification.
Encryption for sensitive reports
If your report contains sensitive information or proof of concept code, we encourage you to encrypt it using our PGP key. Contact us at info@mazelgrandhms.com to request our public PGP key.
Our commitments to researchers
We commit to the following when handling vulnerability reports:
- Prompt acknowledgement: we will acknowledge receipt of your report within 2 business days.
- Investigation: we will investigate the issue and validate the vulnerability.
- Regular updates: we will keep you informed of our progress and expected timeline for a fix.
- Fix verification: we will verify that the fix resolves the issue before deployment.
- Credit attribution: with your permission, we will credit you in our security advisories or acknowledgements.
- No legal action: we will not pursue legal action against researchers who act in good faith and comply with this policy.
Expected timeline
We aim to follow this timeline for handling vulnerability reports:
- Acknowledgement: within 2 business days of receiving your report.
- Initial assessment: within 5 business days, we will assess the severity and determine the remediation plan.
- Fix development: we will develop and test a fix as quickly as possible, typically within 10-20 business days depending on severity.
- Deployment: we will deploy the fix once it has been tested and validated.
- Public disclosure: we will coordinate public disclosure with you and only disclose after the fix is deployed.
Safe harbour
We offer safe harbour to researchers who comply with this policy. If you report a vulnerability in accordance with these guidelines, we will not take legal action against you or refer you to law enforcement authorities.
Safe harbour applies if you:
- Act in good faith and without malicious intent.
- Do not access, exfiltrate, or modify data beyond what is necessary to demonstrate the vulnerability.
- Do not exploit the vulnerability to cause harm or disruption.
- Do not disclose the vulnerability publicly before we have had a reasonable time to fix it.
- Provide us with sufficient information to reproduce and fix the issue.
What we do not authorise
We do not authorise the following activities, even if they are conducted with good intentions:
- Using automated tools to scan our systems without prior permission.
- Accessing or modifying data belonging to other users or clients.
- Disrupting service availability or causing performance degradation.
- Testing against production systems without first attempting to reproduce in a non-production environment if one exists.
- Sharing proof of concept code that could be used to exploit the vulnerability before it is fixed.
Bounty or rewards
Mazel Grand HMS does not currently offer a monetary bounty programme for vulnerability reports. However, we recognise the valuable contribution of security researchers and will acknowledge responsible disclosures appropriately.
If you require a bounty to report a vulnerability, please let us know in your report and we will consider the request on a case-by-case basis.
Coordination and disclosure
We coordinate public disclosure with researchers to ensure vulnerabilities are fixed before they are made public.
- Disclosure timing: we will agree on a disclosure timeline with you, typically after the fix is deployed.
- Credit: with your permission, we will credit you in our security advisory or acknowledgement page.
- Anonymity: if you prefer to remain anonymous, we will respect your wish and not disclose your identity.
- Coordinated disclosure: we will work with you to prepare a coordinated disclosure if you wish to publish your own write-up.
Questions about this policy
If you have questions about this policy or whether a specific type of testing is authorised, please contact us at info@mazelgrandhms.com before proceeding.
We are happy to clarify scope and provide guidance on responsible testing practices.
Contact
Security vulnerability reports: info@mazelgrandhms.com (subject line: "Security report").
General questions about this policy: info@mazelgrandhms.com.