Responsible Disclosure Policy

At NRG PALLAS, we consider the security of our systems and data important. Despite all precautionary measures, a vulnerability may still be present. Have you discovered a vulnerability in an NRG PALLAS system? We ask you to report it to us responsibly so that we can take appropriate measures.

What can you report?

You can report security vulnerabilities that pose a risk to the confidentiality, integrity or availability of our systems and data, such as:

  • Opportunities to gain unauthorised access to non-public information or documents;
  • Vulnerabilities that allow data to be viewed, modified or deleted via forms or other parts of the website;
  • Security issues in web forms, search functions or other interactive parts of the website; and/or
  • Other security flaws that demonstrably pose a security risk.

Conditions (Rules of Engagement)

The reporter is expected to:

  • not disclose the vulnerability publicly, but share it with NRG PALLAS and give us time to resolve the issue;
  • not misuse the vulnerability;
  • only report vulnerabilities that fall within the scope of this policy;
  • only use techniques that are necessary to demonstrate the vulnerability and do not cause unnecessary disruption;
  • not repeatedly gain unnecessary access to the system or share such access with others;
  • provide sufficient information about the vulnerability so that it can be addressed in a targeted manner; and
  • not copy, modify and/or delete the system and/or the data in that system.

Which findings are outside the scope of this policy?

Some findings will not be handled as reports and are excluded, for example:

  • Distributed Denial of Service (DDoS) attacks;
  • Brute force attacks;
  • Social engineering and phishing attacks targeting employees/customers;
  • Reports on encryption settings that, according to the current NCSC guidelines, are considered “sufficient” or “good” will not be treated as vulnerabilities and fall outside the scope of this policy;
  • Old versions of applications that are not vulnerable yet;
  • Automatically generated bulk reports without validation, reproduction steps and demonstrable impact;
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages;
  • Fingerprinting/version banner disclosure on general/public services;
  • Publicly accessible files and folders containing non-sensitive information (e.g. robots.txt);
  • Clickjacking and related vulnerabilities;
  • CSRF on forms that are available without a session (e.g. a contact form/login form);
  • Cross-Site Request Forgery on logout functionality;
  • The presence of ‘autocomplete’ or ‘save password’ functionality;
  • Missing ‘Secure’ or ‘HTTP Only’ flags on non-sensitive cookies;
  • Weak CAPTCHA or CAPTCHA bypass;
  • Username/email enumeration through brute-force attempts via login error messages or ‘Forgot password?’ error messages;
  • Missing HTTP Security Headers such as Strict-Transport-Security, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Content-Security-Policy, X-Content-Security-Policy and X-WebKit-CSP;
  • Missing HTTP Public Key Pinning (HPKP);
  • Host Header Injection unless there is demonstrable impact;
  • The presence of authenticated FTP access;
  • Content spoofing/text injection on 404 pages;
  • Information leakage in metadata;
  • SSL configuration weaknesses: SSL attacks that cannot be exploited externally, missing SSL Forward Secrecy and weak or insecure SSL cipher suites;
  • Same Site Scripting / localhost DNS record;
  • WordPress-related wp-cron.php, p-json user endpoint and xmlrpc.php vulnerabilities, where exploitation is limited to a so-called ‘pingback denial-of-service’ attack;
  • Physical/on-site attacks;
  • Spam/test messages that cause disruption to third parties;
  • Reports that only describe theoretical vulnerabilities without any form of evidence.

How can you submit a report?

Have you discovered a vulnerability? Report it via our security.txt file. Please include at least:

  • Which vulnerability was found;
  • The location (URL/IP/system) where the vulnerability was found and which object(s) it concerns;
  • The steps used to find the vulnerability, so that it can be reproduced;
  • Screenshots for clarification;
  • How we can contact you (email is preferred).

What can you expect from us?

If your report complies with this policy, NRG PALLAS will:

  • confirm receipt of your report;
  • keep in contact with you about progress;
  • take sufficient measures to handle the reporter’s data carefully. We will treat your report confidentially and will not share personal data with third parties without your consent, unless required by law or by a court ruling; and
  • delete the reporter’s personal data once the vulnerability has been resolved.

Acknowledgement

NRG PALLAS appreciates reports of security vulnerabilities and the contribution of researchers to a secure digital environment. The purpose of this policy is to provide a safe and responsible reporting route for vulnerabilities, not to financially incentivise security research. Therefore, NRG PALLAS does not provide financial rewards, compensation or other consideration for reports made under this Responsible Disclosure Policy. With your help, we contribute to a safer digital world.