Vulnerability Disclosure Policy

The security of our systems is a top priority. We appreciate the invaluable help of security researchers and we are committed to working with the community to verify and address any potential vulnerabilities reported to us. This policy describes what systems are in scope, how to report vulnerabilities, and our commitment to you.

Scope

The following domains are in scope:

• *.imobox.ro

The following are explicitly out of scope:

• Third-party services or applications we use.
• Physical security of our offices or data centers.
• Social engineering (e.g., phishing) of our staff.
• Denial of Service (DoS or DDoS) attacks.

Rules of Engagement

• Do not access, modify, or delete data that does not belong to you.
• Do not make a vulnerability public before we have had a reasonable amount of time to fix it.
• Avoid privacy violations and disruptions to our services.
• Testing should be limited to identifying a vulnerability; do not attempt to exploit it further.

Safe Harbor

We consider security research and vulnerability disclosure activities conducted under this policy to be authorized and lawful. We will not initiate legal action against researchers for accidentally violating this policy as long as they act in good faith. If you have any concerns, please contact us before proceeding.

How to Report a Vulnerability

Please send your report to contact@imobox.ro. For sensitive information, please use our PGP key. Your report should include:

• A clear description of the vulnerability.
• The affected URL or system component.
• Step-by-step instructions to reproduce the issue.
• The potential impact of the vulnerability.

Our Commitment

If you follow this policy, we commit to:

• Acknowledge receipt of your report within 2 business days.
• Provide an initial assessment of the report within 5 business days.
• Keep you informed of our progress.
• Recognize your contribution on our Acknowledgments page, if you wish.