Vulnerability Disclosure Policy
Last Updated: August 28, 2026
1. Our Commitment
Smart Business System takes the security of our platform and customer data seriously. We welcome reports from security researchers who discover potential vulnerabilities in good faith.
[PLACEHOLDER: Add company commitment statement — e.g., "We commit to acknowledging your report within X business days and working with you to resolve confirmed issues."]
2. How to Report
Please send vulnerability reports to:
- Email: security@smartbusinesses360.com
- Subject line:
[Security Report] — Brief description
Your report should include:
- A clear description of the vulnerability
- Steps to reproduce the issue
- Potential impact / severity assessment
- Your contact information (optional but helpful)
3. Response Timeline
| Action | Timeline |
|---|---|
| Acknowledgement of report | [PLACEHOLDER: e.g., within 3 business days] |
| Confirm validity of vulnerability | [PLACEHOLDER: e.g., within 10 business days] |
| Issue resolved and reporter notified | [PLACEHOLDER: e.g., within 90 days depending on severity] |
4. In Scope
[PLACEHOLDER: List what systems/domains are in scope, e.g., app.smartbusinesses360.com and any subdomains.]
5. Out of Scope
The following are not considered valid vulnerabilities:
- Denial of service (DoS/DDoS) attacks
- Social engineering or phishing attacks against our staff or users
- Physical attacks on our infrastructure
- [PLACEHOLDER: Add additional out-of-scope items]
6. Safe Harbour
[PLACEHOLDER: Add safe harbour statement — e.g., "We will not take legal action against researchers who report vulnerabilities in good faith following this policy, and we will not share your personal information with law enforcement without your consent."]
7. Bug Bounty
[PLACEHOLDER: Specify whether a bug bounty program exists, and if so, the rewards structure. If no bounty exists, state that clearly — e.g., "We currently do not offer monetary rewards, but we will publicly credit you with your permission."]