Vulnerability Disclosure Policy

Report a vulnerability

Report privately to [email protected].

Include the affected URL or subdomain, a description of the issue, the smallest safe reproduction steps, potential impact, and your preferred contact details. Redact personal information, credentials, and client data. Do not send sensitive evidence until we agree on a secure transfer method.

Scope

This policy covers auditsuisse.com and its subdomains that Auditsuisse controls. Third-party services, including externally hosted booking, analytics, and vendor platforms, remain subject to their owners’ policies. Do not test a third-party system without its owner’s permission.

What we ask of researchers

• Use only accounts and data you own or have explicit permission to test.
• Use the minimum activity needed to demonstrate the issue. Stop immediately if you encounter personal information, client data, credentials, or service disruption.
• Do not download, alter, retain, or disclose other people’s data. Tell us what you encountered without including the data itself.
• Do not use phishing, social engineering, physical attacks, denial of service, persistence, or destructive testing.
• Report privately and coordinate any public disclosure with us after a fix is available.

Our response

Acknowledgment target: 2 business days after receipt.

We will investigate reports, ask for clarification where necessary, and keep the reporter informed of material progress. Remediation timing depends on severity and complexity. We will coordinate public disclosure with the reporter after a fix is available. This policy does not offer a bug bounty or guarantee a reward.

Safe harbor

For good-faith research conducted within this policy, Auditsuisse will treat the activity as authorized and will not initiate legal action against the researcher for that activity. This commitment applies only to systems and rights Auditsuisse controls; it does not authorize access to third-party systems or bind other parties. If you are unsure whether a test is in scope, contact us before proceeding.

Out of scope

• Third-party systems outside our control and testing against customer environments.
• Social engineering, physical security testing, denial of service, spam, and destructive testing.
• Automated scanner output without a reproducible security impact.
• General service requests, billing disputes, and speculative issues with no demonstrated impact.

Machine-readable contact information: security.txt.