Security Disclosure Policy

1. How to report

Submit your report through the contact form on vinemobile.net and choose the topic "General enquiry". We do not publish an email address, so the form is the single channel that ensures your report is logged and routed to our security team.

Please include the affected URL, a description of the issue, steps to reproduce, and any proof of concept. Do not include sensitive personal data you may have encountered.

2. Scope

In scope:

• vinemobile.net and its subpaths, including forms and the website assistant

Out of scope:

• Third-party services and platforms we use, which should be reported to their owners
• Social engineering of our staff or clients, physical attacks and phishing
• Denial-of-service testing, spam and automated high-volume scanning
• Reports from automated tools without a demonstrated impact, such as missing headers with no exploit path

3. Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, will not pursue legal action against you, and will work with you to understand and resolve the issue. This protection applies only to activity within the scope described here and does not cover violations of law unrelated to this policy.

4. Rules of engagement

When researching, please:

• Access only the minimum data needed to demonstrate the issue
• Do not modify, delete or exfiltrate data, or degrade service for others
• Stop testing and report immediately if you encounter personal or client data
• Give us reasonable time to fix the issue before sharing it publicly

5. What you can expect from us

We acknowledge reports and respond with an initial assessment within 3 business days. We will keep you informed of our progress, tell you when the issue is fixed, and, if you wish, credit you for the discovery once it is resolved.

6. How we handle reports

Reports are triaged by our security team, reproduced, rated by severity and assigned for remediation. We handle the information you share confidentially and use it only to investigate and fix the issue.

7. Recognition

We do not operate a paid bounty program at this time. With your permission, we are glad to acknowledge researchers who help us improve.

8. Client systems

This policy covers vinemobile.net only. It does not authorize testing of any client environment we manage. If you discover an issue affecting a client, report it through the contact form and we will notify the right people.