Vulnerability Disclosure Program (VDP)

1. Purpose

Servbase welcomes good-faith security research that helps us improve the security of our platform and users. This Vulnerability Disclosure Program ("VDP") explains how to report vulnerabilities responsibly.

2. In-Scope Systems

• Servbase-owned web properties under servbase.net and subdomains.
• Servbase authentication flows, dashboard, and account-management features.
• Servbase public APIs and platform endpoints operated by Servbase.

Third-party services and assets not controlled by Servbase are out of scope unless explicitly stated by Servbase in writing.

3. How to Report

Send reports to [email protected] with enough detail for reproduction and validation.

• Affected URL, endpoint, feature, or component.
• Clear reproduction steps and expected vs actual behavior.
• Proof-of-concept artifacts (request/response samples, screenshots, logs) where available.
• Potential impact and suggested remediation, if known.

Do not include sensitive customer data beyond what is strictly necessary to demonstrate the issue.

4. Researcher Requirements

• Act in good faith and avoid privacy violations, service disruption, and data destruction.
• Do not access, modify, or exfiltrate data that does not belong to you.
• Do not perform denial-of-service, social engineering, phishing, or physical attacks.
• Do not publicly disclose vulnerabilities before Servbase has had reasonable time to investigate and remediate.

5. Safe Harbor

If you comply with this VDP and applicable law, Servbase will not initiate legal action against you for your good-faith research activities under this program.

This safe harbor does not apply to malicious activity, privacy violations, extortion attempts, service disruption, or actions outside this policy.

6. Out of Scope

• Vulnerabilities in third-party products or services not operated by Servbase.
• Automated or low-impact findings without a demonstrable security impact (for example basic banner or version disclosures).
• Reports requiring unrealistic user interaction without practical exploitability.
• Spam, duplicate reports without new technical value, or non-security support requests.

7. Response Process

• Servbase will acknowledge valid reports as soon as reasonably possible.
• We will triage, assess impact, and prioritize remediation based on risk.
• We may request additional details during investigation.
• Disclosure coordination timelines may vary depending on complexity and operational risk.

Servbase does not guarantee monetary rewards unless explicitly offered in writing.

8. Legal Terms

Servbase reserves the right to modify this VDP at any time. Continued participation after updates constitutes acceptance of the revised policy, where legally permitted.

This VDP supplements, and does not replace, Servbase Terms of Service, Privacy Policy, and other applicable legal documents.