Vulnerability Disclosure Program

Collaborating for Safer Code

Introduction

This Vulnerability Disclosure Program (VDP) outlines the processes and procedures for reporting security vulnerabilities in the systems and applications developed by Mythicsoft Ltd. The goal of this program is to ensure that vulnerabilities are identified, reported, and remediated in a responsible manner to protect our clients’ assets and data.

Scope

This VDP applies to all software products, systems, and network devices developed and maintained by Mythicsoft Ltd.

Reporting a Vulnerability

  • Contact Information: Security researchers and the general public can report vulnerabilities via email at support@mythicsoft.com or through our online reporting form at https://www.mythicsoft.com/support/.
  • Required Information: When reporting a vulnerability, please include the following information:
    • Description of the vulnerability.
    • Steps to reproduce the vulnerability.
    • Potential impact of the vulnerability.
    • Any relevant screenshots or proof-of-concept code.

Responsible Disclosure Policy

  • No Legal Action: Mythicsoft Ltd will not take legal action against individuals who discover and report vulnerabilities, provided they adhere to this VDP.
  • Do No Harm: Security researchers must not exploit the vulnerability or access, modify, or delete any data without authorization.
  • Coordinated Disclosure: Reported vulnerabilities will be addressed promptly, and Mythicsoft Ltd will coordinate with the reporter on public disclosure timelines.

Acknowledgement and Response

  • Acknowledgement: Mythicsoft Ltd will acknowledge the receipt of the vulnerability report within two business days.
  • Assessment: The security team will assess the reported vulnerability and determine its validity and severity.
  • Remediation: Valid vulnerabilities will be prioritized and remediated based on their severity and impact.
  • Notification: The reporter will be notified of the remediation status and any relevant updates.

Rewards and Recognition

  • Complimentary licences: Mythicsoft Ltd offers complimentary licences to researchers who supply valid vulnerability reports.
  • Recognition: Security researchers who report valid vulnerabilities may request public recognition of their work on our web site.

Confidentiality

  • Confidential Information: Mythicsoft Ltd will not share the identity or personal information of the reporter without their consent.
  • Public Disclosure: Vulnerabilities will only be publicly disclosed after a fix has been implemented and the reporter has been notified.

Program Review and Updates

  • Periodic Review: This VDP will be reviewed and updated periodically to ensure its effectiveness and alignment with industry best practices.
  • Continuous Improvement: Feedback from security researchers and lessons learned from previous reports will be used to improve the program.