Responsible Vulnerability Disclosure Policy

Introduction

At TMT, the security of our systems is a top priority.

We value the contributions of security researchers and the broader security community in helping us maintain a secure environment for our users and data. This policy provides guidelines for security researchers to report potential vulnerabilities in our systems and outlines our commitment to working with the community to verify, reproduce, and respond to legitimate reports.

Scope

This policy applies to all public-facing TMT web applications and services.

While we encourage research into our systems, the following are out of scope:

• Physical security of TMT facilities
• Social engineering (e.g., phishing, vishing) of TMT employees, contractors, or customers 
• Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks 
• Reports from automated vulnerability scanners with no additional analysis
• Vulnerabilities in third-party services or applications that integrate with TMT

How to Report a Vulnerability

If you believe you have discovered a security vulnerability in one of our in-scope systems, please report it to us by filling in the form below:

What to Expect From Us

Upon receiving your report, we are committed to the following:

• We will acknowledge receipt of your report within 5 business days.
• We will triage your report and provide an expected timeline for resolution.
• We will maintain an open line of communication with you throughout the remediation process.
• We will notify you when the vulnerability has been resolved.

Safe Harbour

TMT will not initiate legal action against security researchers who discover and report vulnerabilities in good faith and in accordance with this policy.

We consider research conducted under this policy to be authorised and will not pursue civil action or file a complaint with law enforcement for accidental, good-faith violations of this policy.

Rules of Engagement

We ask that all security researchers adhere to the following rules:

• Do not access, modify, or delete any data that does not belong to you.
• Do not disrupt any of our services or systems.
• Do not publicly disclose any vulnerability without our prior written consent. We will work with you to coordinate a public disclosure if appropriate.
• Provide us with a reasonable amount of time to resolve the issue before any public disclosure.

Acknowledgments

To show our appreciation for the security researchers who help us keep our systems secure, we would like to offer public recognition on our website. Please let us know if you would like to be publicly credited for your discovery.