Introduction

At present Helyx does not operate a public bug bounty however we recognise the need to receive responsibly disclosed vulnerabilities. This policy is intended to give guidelines for submitting vulnerabilities discovered in Helyx’s web platform and its subdomains:

*.helyx.co.uk

If you believe you’ve found a vulnerability in another Helyx website or system, please contact the owner. If there is not a point of contact (or no response) you can submit your report to us.

This vulnerability disclosure policy applies to any vulnerabilities you are considering reporting to us. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always acting in compliance with it.

We are grateful to those who take the time and effort to report security vulnerabilities according to this policy. However, we do not offer monetary rewards for vulnerability disclosures.

Proper disclosure

Helyx supports the efforts of the internet community to make the online world a safer place for everyone.

Therefore, Helyx’s vulnerability disclosure policy is following the latest vulnerability disclosure toolkit provided by the NCSC and the ISO/IEC 29147:2018 Information technology — Security techniques — Vulnerability disclosure guidelines.

Reporting

If you believe you have discovered a vulnerability please submit your report to us.

Please include the following information:

• Your name
• Your email address
• Issue type: A brief description of the type of vulnerability, for example; “XSS vulnerability”.
• The website, IP, or page where the vulnerability can be observed, and the affected Helyx product(s) or service(s)
• A suitable risk rating and/or CVSS score
• Replication steps. These should be a benign, non-destructive, proof of concept. This helps to ensure that the report can be triaged quickly and accurately.

What to expect

After you have submitted your report, we will respond to your report within 5 working days and aim to triage your report within 10 working days. We’ll also aim to keep you informed of our progress.

Priority for remediation is assessed by looking at the impact, severity, and exploit complexity. Vulnerability reports might take some time to triage or address. You are welcome to enquire on the status but should avoid doing so more than once every 10 working days. This allows our teams to focus on the remediation.

We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately.

Guidance

You must not:

• Break any applicable law or regulations
• Access unnecessary, excessive, or significant amounts of data
• Modify data in the Helyx’s systems or services
• Use high-intensity invasive or destructive scanning tools to find vulnerabilities.
• Attempt or report any form of denial of service, e.g. overwhelming a service with a high volume of requests
• Disrupt the Helyx’s services or systems
• Communicate any vulnerabilities or associated details other than by means described in the published security.txt
• Social engineer, ‘phish’ or physically attack the Helyx’s staff, contractors or infrastructure
• Reports detailing non-exploitable vulnerabilities, or reports indicating that the services do not fully align with “best practice”, for example missing security headers or clickjacking
• Reports detailing TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS1.0 etc
• Reports detailing any invalid or missing SPF (Sender Policy Framework) records
• Demand financial compensation in order to disclose any vulnerabilities
• Submit reports from automated tools or scans
• Issue any physical attempts against property or IT infrastructure belonging to Helyx or any of our IT hosting and network service providers
• Perform attacks requiring physical access to a user’s device

Report spam or phishing (please see our guidance for more information on what to do if you receive phishing emails that pretend to come from Helyx). Permission is required from Helyx before using automated tools or scans, performing brute force attacks, or denial of service. Any attacks which affect other users or infrastructure will not comply with this policy.

You must:

Always comply with data protection rules and must not violate the privacy of the Helyx’s customers, staff, contractors, services, or systems. You must not, for example, share, redistribute or fail to properly secure data retrieved from the systems or services.
Securely delete all data retrieved during your research as soon as it is no longer required or within 1 month of the vulnerability being resolved, whichever occurs first (or as otherwise required by data protection law).

Legalities

You are solely responsible for your own compliance with law. Complying with this policy is not intended to provide you with any protection if you breach the law, nor does this policy give you permission to act in any manner that is inconsistent with the law as it applies to you or Helyx.