Security policy

Reporting a vulnerability

Email security reports to admin@bipcircle.com. Include a clear description, the steps to reproduce it and any proof of concept. We acknowledge reports within 2 business days and aim to send a status update within 10 business days.

Scope

This policy covers bipcircle.com and its subdomains. Third party services, social engineering, physical attacks and denial of service testing are out of scope unless we have agreed them with you beforehand.

Safe harbour

We will not pursue legal action against researchers who act in good faith, avoid privacy violations and service disruption, give us reasonable time to fix an issue before disclosing it, and do not access or change data that is not their own.

Please do not

• Test against real user data.
• Run automated scans that degrade the service.
• Disclose details publicly before we have had a chance to fix the issue.

What happens next

1. We acknowledge your report.
2. We triage it and assess severity.
3. We fix or mitigate the issue.
4. We agree disclosure with you where that is appropriate.