Algo Roma

Legal

Responsible disclosure

Last updated

We test other organisations’ systems for a living, so we take reports about our own seriously. If you believe you have found a security vulnerability in a system Algo Roma operates, please tell us. We will work with you to understand and fix it.

How to report

Email info@algoroma.tech with the subject line Security report. Please include:

  • the affected URL, host or system,
  • a description of the vulnerability and its impact,
  • step-by-step instructions to reproduce it, with any requests, payloads or screenshots,
  • your name or handle if you would like to be credited.

Our security.txt file lists the same contact details in a machine-readable form.

Scope

In scope

  • algoroma.tech and its subdomains operated by Algo Roma.

Out of scope

  • Services run by third parties, such as our hosting or email providers. Report those to the provider.
  • Systems belonging to our clients. If you believe you have found an issue in a client’s system, report it to that organisation directly.
  • Denial-of-service, load or volumetric testing.
  • Social engineering, phishing or physical attacks against our staff or offices.
  • Reports from automated scanners without a demonstrated, exploitable impact.
  • Missing best-practice headers or email records (SPF, DKIM, DMARC) unless you can show a concrete attack.

Rules of engagement

When investigating, please:

  • only access the minimum data needed to show the issue, and do not view, change or delete data that is not yours,
  • stop and report as soon as you confirm a vulnerability,
  • avoid anything that degrades the service for other users,
  • keep the details confidential until we have fixed the issue or agreed a disclosure date with you.

What we commit to

  • We will acknowledge your report within 3 business days.
  • We will confirm whether we can reproduce it and keep you updated as we work on a fix.
  • We will let you know when it is resolved and agree a public disclosure date with you if you want to publish.
  • With your permission, we will credit you publicly once the issue is fixed.

We do not run a paid bug bounty programme at this time.

Safe harbour

If you act in good faith and follow this policy, we will consider your research authorised, we will not take legal action against you, and we will not report you to law enforcement. If a third party takes action against you for research that followed this policy, we will make it known that your work was authorised.

This does not authorise testing of any system outside the scope above.