1. Introduction
Phare aims to be a safe place for everyone. If you have discovered a security vulnerability, Phare appreciates your help in disclosing it in a responsible manner. Phare will investigate all legitimate reports and do its best to quickly fix the problem.
2. Safe harbor
To encourage responsible disclosures, Phare will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy. Phare considers security research and vulnerability disclosure activities conducted consistent with this policy to constitute “authorized” conduct under the Computer Fraud and Abuse Act, the DMCA and applicable anti-hacking laws such as Cal. Penal Code 502(c). Phare waives any DMCA claim against you for circumventing the technological measures used to protect the applications in scope.
If legal action is initiated by a third party against you, and you have complied with this bug bounty policy, Phare will take steps to make it known that your actions were conducted in compliance with this policy.
Please understand that if your security research involves the networks, systems, information, applications, products, or services of another party (which is not Phare), that third party may determine whether to pursue legal action. Phare cannot and does not authorize security research in the name of other entities.
You are expected, as always, to comply with all applicable laws.
Please submit a report to Phare before engaging in conduct that may be inconsistent with or unaddressed by this policy.
3. Rules
To ensure the security of the platform and the privacy of its users, Phare has established the following rules for vulnerability disclosure. Please adhere to these guidelines when conducting security research and reporting vulnerabilities:
- Conduct testing only on your own accounts and resources. Do not target Phare users or their resources.
- Phare recommends including a custom HTTP header in your requests while testing.
- Ensure your reports include detailed, reproducible steps to facilitate investigation.
- Make every effort to avoid violating privacy, destroying data, or degrading service during your testing.
4. Disclosure
If you discover a vulnerability or security concern related to Phare, please report it by contacting security@phare.io. To help address the issue promptly, include detailed exploit steps and, if possible, a proof of concept.
Phare treats all security disclosures with the utmost seriousness. Upon receiving a report, Phare rapidly verifies the vulnerability and takes the necessary steps to resolve it. Once verified, you will be kept informed of the progress and notified when the issue is fully resolved.
5. Recognition
Phare appreciates the efforts of security researchers who help maintain the security of the platform. If you report a legitimate security vulnerability, your efforts will be publicly recognized in some way to be determined in the future. Phare is also not in a position to offer monetary rewards for vulnerability disclosures at this time. As a form of gratitude, Phare may provide you with a free subscription or other benefits.
Questions?
If you have any questions or concerns about Phare’s vulnerability disclosure policy, please don’t hesitate to reach out.
Email support@phare.io, or check out the contact page for more options.