Responsible Disclosure

At Instruqt, we give utmost importance to the safety of systems. However, there can be weak points in our systems despite the care we take regarding security. We invite you to report these vulnerabilities to us.

However, due to a high volume of trivial and/or false reports, we are limiting the scope of reports to the play.instruqt.com domain. Additionally, please refrain from investigating and/or reporting other domains and for items mentioned in the Out of Scope section.

Instruqt already contracts third parties to perform penetration tests periodically. Output from automated security scan tools (e.g. Burp Suite and others) is therefore unlikely to yield new information or vulnerabilities, and will generally not result in a bug bounty award.

Collaboration

If you have found a weakness, we would like to hear about it so that we can take appropriate measures as quickly as possible. We are keen to cooperate with you to better protect our users and systems.

Not an invitation to actively scan

This Responsible Disclosure policy is not an invitation to actively scan our network and systems for weaknesses. We monitor our systems, and are likely to pick up your scan. Our security team will investigate unusual activity, possibly leading to unnecessary costs.

Judicial prosecution

During your investigation it could be possible that you take actions that are prohibited by law. If you follow the conditions given in this agreement, we will not take legal action against you. However, do note that the Public Prosecutor always has the right to decide whether or not to prosecute you.

What we ask of you

  • Please report your findings as soon as possible to security@instruqt.com
    Optionally encrypt your findings with our PGP key to prevent the information from falling into the wrong hands.
  • Do not abuse the found vulnerability, for example by downloading more data than necessary, or by changing or removing data.
  • Be extra cautious with personal data.
  • Do not share the vulnerability with others until it is resolved.
  • Do not test the physical security or third-party application, social engineering techniques (distributed) denial-of-service, malware, or spam.
  • Describe the issue found as explicitly and in detail as possible, and provide any evidence you might have.
  • Do provide sufficient information to reproduce the problem so that we can resolve it as quickly as possible. Usually, the IP address or the URL of the affected system and a description of the vulnerability is sufficient, but complex vulnerabilities may require further explanation.

What we promise

  • We will respond to your report within 5 business days with our evaluation of the report and an expected resolution date.
  • We will keep your report anonymous and will not pass on your personal details to third parties without your permission, unless the law requires us to provide your personal information.
  • We will keep you informed of the progress towards resolving the problem.
  • You can report anonymously or under a pseudonym. In this case, however, we will not be able to contact you for things such as follow-up steps, progress of resolving the issue, publication or any reward for reporting.
  • We may give you a reward for your research but are not obliged to do so. You are, therefore, not automatically entitled to a reimbursement. The form of this reward is not fixed in advance and is determined by us on a case-by-case basis. Awards are not given for already known issues.
  • We strive to solve all problems as quickly as possible and keep all parties involved informed. We will be glad to be involved in any publication about the weakness after it has been resolved.

Out of scope

Instruqt does not reward trivial vulnerabilities, bugs that cannot be abused or vulnerabilities/bugs that we are already aware of. The following are examples of known and accepted vulnerabilities and risks that are outside the scope of the responsible disclosure policy:

  • HTTP 404 codes/pages or other HTTP non-200 codes/pages and Content Spoofing/Text Injection on these pages.
  • Fingerprint version banner disclosure on common/public services.
  • Disclosure of known public files or directories or non-sensitive information, (e.g. public storage buckets or robots.txt).
  • Clickjacking and issues only exploitable through clickjacking.
  • Session hijacking and issues only exploitable through session hijacking.
  • Issues only exploitable through Man-in-the-Middle (MITM) attacks.
  • (Distributed) Denial of Service attacks and other rate limiting related attacks.
  • Lack of Secure/HTTPOnly flags on non-sensitive Cookies.
  • OPTIONS HTTP method enabled.
  • Anything related to HTTP security headers, e.g.: Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy.

‍This responsible disclosure policy is inspired by the “Responsible Disclosure” page of the SURF Coorporation, licenced under the Creative Commons Attribution 4.0 International licence.