Our Commitment to Security

At Second Front Systems, the security of our platform and our customers’ data is our highest priority. We value the vital role that independent security researchers play in the broader cybersecurity ecosystem. This Vulnerability Disclosure Program is intended to provide clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.

Good-Faith Authorization (Safe Harbor)

We officially authorize good-faith security research and the disclosure of vulnerabilities to our organization. If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and we will not initiate or recommend legal action related to your research.

Rules of Engagement & Disclosure Timelines

To protect our customers and system integrity, we require that all researchers adhere to the following rules of engagement:

• Do no harm: You must not exploit a vulnerability beyond what is necessary to prove it exists. Do not alter or destroy data, or interrupt/degrade our services (e.g., Denial of Service attacks).
• Remediation Window: We do not condition our authorization on indefinite non-disclosure. However, we require a 90-day remediation window to properly investigate and mitigate the vulnerability before you disclose it publicly.
• Privacy: If you encounter personally identifiable information (PII) or other sensitive data, you must halt your activity, purge the data from your local system, and immediately report the vulnerability to us.