Vulnerability disclosure policy

Send your report to security@dotnetholdings.com. Please include the affected site or service, a clear description of the issue, the steps to reproduce it, and any supporting material such as screenshots or a proof of concept. The more detail you provide, the faster we can validate and fix the issue.

When you report an issue in good faith under this policy, we will acknowledge your report, keep you informed as we investigate, work to remediate valid issues in a reasonable timeframe, and credit you if you wish once the issue is resolved. We will not pursue or support legal action against you for research and disclosure conducted in accordance with this policy.

To keep research safe for everyone, please:

• give us a reasonable opportunity to remediate before disclosing an issue publicly;
• avoid privacy violations, and do not access, modify, or delete data that does not belong to you;
• do not degrade, disrupt, or overload our services, and avoid automated testing that could do so;
• do not use social engineering, physical attacks, or denial of service techniques;
• use only your own accounts or test accounts for testing.

This policy covers the public websites and services operated by DotNet Holdings. Some of the companies we operate run their own products and may have their own reporting channels. If you are unsure where an issue belongs, send it to us and we will route it to the right team.