Effective
If you believe you have found a security vulnerability in a website or service PrimeServ operates, please report it to us privately so we can fix it. We welcome reports from security researchers and will work with you in good faith.
How to report
Send a message and choose “Legal or privacy request,” starting your message with “Security vulnerability” so we can recognize it quickly. Please include:
- a description of the vulnerability and its potential impact;
- the affected web address, component or service;
- step-by-step instructions to reproduce it;
- how we can reach you, and whether you would like to be credited.
Please do not include other people’s personal information in your report. If you need to send files, such as screenshots or proof-of-concept code, tell us and we will arrange a secure way to receive them.
Scope
This policy covers websites and services that PrimeServ operates, including primeserv.com, its forms and file uploads, and our staff dashboard. The following are out of scope:
- Client applications. Apps and systems we build or support for clients belong to those clients. Please report vulnerabilities in them to the organization that provides the app. If you cannot reach that organization, contact us and we will try to pass your report on.
- Third-party services we use, such as our hosting or email providers. Please report issues in them to the provider, under its own policy.
- Social engineering, including phishing, pretexting or other attempts to deceive our staff, clients or partners.
- Physical attacks on our offices, people or devices.
- Denial of service, and load or stress testing.
- Spam, and high-volume or automated submissions to our forms.
Reports without a demonstrated security impact, such as a missing best-practice header or the output of an automated scan alone, are welcome but may not be treated as vulnerabilities.
Rules for research
- Follow this policy and all applicable laws.
- Test only what is in scope, using the least intrusive method that demonstrates the issue.
- Do not access, download, modify or delete data that is not yours. If you come across personal information or other confidential data, stop, do not keep it, and tell us right away.
- Do not guess or brute-force passwords or authenticator codes, and do not use credentials that are not yours.
- Do not degrade or disrupt the site or our services, and do not send more form submissions than you need to show the issue.
- Do not upload malware or other harmful files.
- Give us reasonable time to investigate and fix the issue before you disclose it publicly, and coordinate the timing of any disclosure with us.
- Once you have reported an issue, securely delete any data you obtained during your research.
What you can expect from us
- We will acknowledge your report promptly.
- We will investigate, keep you informed of our progress, and tell you when the issue is fixed.
- We will handle your report confidentially and will not share your personal details without your permission, unless the law requires it.
- If you wish, we will credit you by name when we disclose the issue.
Safe harbor
We consider security research carried out in good faith and in line with this policy to be authorized for the purposes of anti-hacking laws, such as the US Computer Fraud and Abuse Act (18 U.S.C. § 1030), Michigan’s computer crime law (MCL 752.791 and following) and similar laws elsewhere. We will not pursue legal action against you, or refer you to law enforcement, for that research. If a third party brings legal action against you for research that complied with this policy, we will make it known that we authorized it.
This authorization covers only the systems we operate. We cannot authorize research on systems that belong to our clients or other third parties. If you are unsure whether something you plan to do is consistent with this policy, please ask us before you go further.
Rewards
We do not currently run a bug bounty program or pay for reports. We are grateful for every report that helps us keep our clients and visitors safe.