Trust centre · Security
Vulnerability disclosure policy
If you find a security weakness in this website or in the hosted Covenant Desk portal, tell us and we will fix it. This page explains how to report it, what is in scope, the rules for testing, and what we commit to in return.
Section one
How to report a vulnerability
- Email [email protected] with "Security" at the start of the subject line.
- Describe what you found: the affected address, the steps to reproduce it, what an attacker could do with it, and any proof of concept.
- We confirm receipt within three business days and tell you whether we can reproduce it.
- We keep you updated while we fix it, and tell you when the fix is live.
Section two
In scope
covenantdesk.hk
This website and its forms.
my.covenantdesk.hk
The hosted Covenant Desk portal, including the borrower portal and its APIs.
Out of scope
Third-party services we use (report those to the provider), a client's own deployment on its own infrastructure, and findings that need physical access to a device.
Section three
Ground rules for testing
Testing in good faith within these rules is welcome.
Use your own data
Test only with accounts and records you create. Do not access, change or delete another client's or borrower's data. If you reach real personal data by accident, stop, and tell us what you saw.
Keep the service up
No denial-of-service, load or volume testing, and no automated scanning that degrades the service for others.
No people tricks
No phishing, social engineering or physical attempts against our staff, clients or offices.
Give us time
Do not publish details until we have fixed the issue, or 90 days after your report, whichever comes first. We will agree a date with you.
Section four
What we commit to
No legal action
We will not pursue legal action against research done in good faith within these rules.
Credit
With your permission, we credit you when we describe the fix.
No bounty
We do not pay for reports. We will tell you plainly what we did with yours.
Section five
Machine-readable contact
Our contact details for security researchers are also published at /.well-known/security.txt, following RFC 9116.