Vulnerability Disclosure Policy

We build security and compliance software, so we take reports about our own security seriously. If you've found a vulnerability in OneClickComply, we want to hear about it and we'll work with you to get it fixed. This policy sets out what's in scope, how to report, what we expect from you, what you can expect from us and how our rewards work. Read all of it before you send anything. Reports that don't follow it are closed without a reply. FAT32 LTD dba OneClickComply is registered in England and Wales.

Email [email protected]. It's the only channel we accept vulnerability reports through. We don't accept them via live chat, social media, support tickets or our sales team, and we won't respond to them there. Every report must: • Cover one vulnerability. Send separate emails for separate issues. • Use this subject line format: [OCC-VDP] Severity - Affected asset - Short title. For example: [OCC-VDP] High - oneclickcomply.com - Stored XSS in contact form. • Name the exact URL, endpoint, parameter or component affected. • Include step-by-step reproduction instructions and a working proof of concept, with the raw HTTP requests and responses. • Explain the real impact. What can an attacker actually do, and to whom? • Include the date and time you tested (UTC) and the IP address or addresses you tested from. • Be written in English, as plain text or a PDF attachment. Short screen recordings are fine. Don't send links to file-sharing sites, executables or archives. Reports missing any of the above are closed without a reply.

We receive a lot of automated and AI-generated reports. Almost none of them are real. These rules exist to stop that. • You must have personally verified every finding against our live systems before you send it. If you can't reproduce it, don't report it. • You can use AI tools to help you research or write, but you must say so in the report, and you're responsible for every word in it. • Reports that describe endpoints, parameters, software versions or behaviour that don't exist on our systems are closed without a reply. • Raw output from scanners or AI tools is not a report. That includes Burp Suite, Nessus, Acunetix, ZAP, nuclei and AI-generated "security audits". Generic CVE write-ups with no proof that our systems are affected aren't reports either. • Theoretical issues, best-practice advice and "possible" or "potential" vulnerabilities with no demonstrated impact won't be triaged. • Don't send the same report to more than one address, and don't chase it inside the response times below. • You can have a maximum of three open reports with us at any one time. If you send two reports that break these rules, we'll block your email address and domain from future submissions. We won't tell you we've done it.

Don't ask whether we pay, or ask for payment, before you've sent a complete report that follows this policy. We won't reply. Any message that makes disclosure conditional on payment, sets a deadline for payment or threatens to publish a vulnerability will be treated as attempted extortion and may be reported to Action Fraud and the police.

• oneclickcomply.com and www.oneclickcomply.com. • Other subdomains of oneclickcomply.com that we operate, unless they're listed as out of scope below. • The OneClickComply platform, tested using accounts you've registered yourself. • Software and agents published by OneClickComply, tested in an environment you own. Register any test accounts with an email address containing +occvdp (for example, [email protected]) so we can tell your testing apart from real customer activity.

The following are out of scope. Do not test them: • dev.oneclickcomply.com • test.oneclickcomply.com • admin.oneclickcomply.com • Third-party services we use, including HubSpot, Intercom, Stripe, Cloudflare, AWS, Google Cloud, Postmark and Sentry. Report issues in those services to the vendor directly. • Any account, tenant or data that isn't yours, including our customers' environments. • Our offices, staff and physical security. Testing out-of-scope assets isn't authorised, isn't covered by the safe harbour below and is treated as unauthorised access.

The following aren't eligible for triage or reward, unless you can show a real, chained impact on our systems or our customers: • Missing security headers, cookie flags or best-practice configuration. • SPF, DKIM, DMARC or other email configuration. • Clickjacking on pages with no sensitive actions. • CSRF on logout or other non-sensitive actions. • Self-XSS, or anything that requires the victim to paste code into their own browser. • Missing rate limiting. • Username or email address enumeration. • Software version disclosure, banners, error messages or stack traces. • TLS and SSL configuration, including cipher suites. • Open redirects. • Content spoofing and text injection without HTML or script execution. • Issues that need a compromised device, physical access, a man-in-the-middle position or an outdated browser. • Denial of service of any kind, including resource exhaustion. • Vulnerabilities in third-party software, including CVEs published in the last 30 days, without a working exploit against our systems.

When testing, you must: • Only test against accounts and data you own. • Stop as soon as you've confirmed a vulnerability. Don't access, change, delete or keep any data beyond the minimum needed to prove it. • Stop immediately and tell us if you come across personal data or customer data, then delete anything you've kept. • Keep automated testing below 5 requests per second. • Never run denial of service, load testing, spam or anything else that degrades the service for our customers. • Never use social engineering, phishing or physical testing, and never target our staff. • Never use a vulnerability to move further into our systems, plant persistence or exfiltrate data. • Keep the vulnerability confidential until we've fixed it and agreed a disclosure date with you in writing. • Comply with UK law and the law of the country you're testing from.

If your report follows this policy, we'll: • Acknowledge it within 3 business days. • Triage it and confirm a severity within 10 business days. • Update you at least every 14 days until it's fixed. • Aim to fix confirmed issues within 7 days for Critical, 30 days for High, 60 days for Medium and 90 days for Low. • Agree a coordinated disclosure date with you, usually once the fix is live and no later than 90 days after your report unless we agree otherwise. • Credit you publicly once it's fixed, if you'd like us to. Business days are Monday to Friday, excluding UK bank holidays.

We pay discretionary rewards for valid, in-scope vulnerabilities that are reported first and follow this policy in full: • Critical: up to £2,000. For example, remote code execution, or authentication bypass that exposes another customer's data. • High: up to £750. For example, access to another tenant's data through an IDOR, privilege escalation, or stored XSS that affects other users of the platform. • Medium: up to £250. For example, CSRF on a sensitive action, or reflected XSS on an authenticated page. • Low: up to £50, or a public thank you. We use CVSS v3.1 as a starting point and adjust for the real-world impact on our customers. The small print: • Only the first valid report of an issue is rewarded. Duplicates aren't. • Multiple issues with the same root cause count as one report. • We decide severity and reward amounts, and our decision is final. • We pay in GBP by bank transfer within 30 days of the fix going live. You're responsible for any tax due. • You must be 18 or over, and not a current or former (in the last 12 months) employee or contractor of OneClickComply, or a close family member of one. • We can't pay anyone we're legally prohibited from paying, including people in sanctioned countries or on sanctions lists. • Breaking any part of this policy means no reward. • We can change or end the reward programme at any time. This doesn't affect reports we've already accepted.

If you act in good faith and follow this policy, we'll consider your research authorised for the purposes of the Computer Misuse Act 1990 and similar laws. We won't take legal action against you or report you to law enforcement for it. If a third party takes legal action against you over activity that followed this policy, we'll make it known that your activity was authorised by us. Safe harbour doesn't cover testing of out-of-scope assets, accessing or keeping data beyond the minimum needed, or breaking any of the rules above. If you're not sure whether something is allowed, ask us at [email protected] before you do it.

[email protected] Our machine-readable security contact details are published at https://oneclickcomply.com/.well-known/security.txt.