Legal
Security disclosure
How to report a security vulnerability in FIQS, and what happens next.
Outline
What this document will cover
- Scope
- Which systems and domains are in scope for testing, and which are explicitly out.
- How to report
- The reporting channel, what to include, and how to send anything sensitive securely.
- Safe harbour
- The commitment not to pursue action against good-faith research conducted within scope.
- What happens next
- Acknowledgement, triage, remediation and the disclosure timeline we work to.
Status
Awaiting legal review
This is the agreed outline, not the executed document. The operative text has to be drafted and reviewed against the confirmed operating entity and jurisdiction — neither of which is settled — so no clause here should be relied on. Publishing plausible-sounding legal text would be worse than publishing the outline honestly.