How to report.
Send your report through the contact form and start the message with "Security report", or message us on WhatsApp. If the details are sensitive, ask for a call first and we will arrange how to receive them.
Please include what you need us to reproduce the issue:
- the affected address or service
- the steps to reproduce it, with screenshots or requests if you have them
- what an attacker could do with it
- how we can reach you for follow-up questions
What to expect from us.
We acknowledge every report within 3 business days and give you a status update within 30 days. We tell you when the issue is fixed and, if you want, credit you by name once it is resolved.
We do not run a paid bug bounty program.
Scope.
In scope: arpsentry.com and the subdomains operated by ArpSentry.
Out of scope: systems we work on for clients, which belong to them, and third-party services we use, such as our email, hosting and social media providers. Please report those to their owners. This policy does not authorise testing of anyone else's systems.
Testing in good faith.
While researching, please:
- do not run denial-of-service or load tests, or automated scans that degrade the service
- do not use social engineering, phishing or physical access against our team
- do not send spam or large volumes of messages through our forms
- access only the data you need to show the issue, and stop and report as soon as you reach personal data
- keep the details confidential until we have fixed the issue or agreed a disclosure date with you
Safe harbour.
If you act in good faith and follow this policy, we will not pursue legal action against you for your research, and we will not ask authorities to do so. If you are unsure whether something is allowed, ask us first.
Contact.
ARP SENTRY SRL · CUI 55602852
Working remotely from Bucharest, Romania.