This Vulnerability Disclosure Policy ("Policy") outlines the process for responsibly disclosing security vulnerabilities to Arifalab Technologies Limited ("we," "us," or "our"). We value the efforts of security researchers and others in identifying and reporting potential security vulnerabilities, and we are committed to working with the security community to ensure the safety and security of our systems and data.

Scope

This Policy applies to vulnerabilities found in systems and services owned, operated, or controlled by Arifalab Technologies Limited, including but not limited to:

1. Web applications and websites (e.g., arifalab.com, app.kqimble.com, kweliguard.net)
2. Mobile applications (iOS and Android)
3. APIs
4. Network infrastructure (e.g., publicly accessible servers)
5. Software developed and distributed by us

This Policy does not apply to:

1. Vulnerabilities in third-party software or services that are not directly under our control. We encourage you to report vulnerabilities to the respective vendors.
2. Social engineering (e.g., phishing, vishing) attacks.
3. Physical security testing (e.g., penetration testing of physical premises).
4. Denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks.
5. Automated vulnerability scanning that negatively impacts our services.
6. Reports based on speculation or rumor.

Reporting a Vulnerability

If you believe you have found a security vulnerability in one of our systems or services, please submit a report to us via [email protected]

Your report should include the following information:

1. Your Contact Information - Your name and email address (or preferred contact method). Anonymous reports are accepted, but providing contact information allows us to communicate with you for clarification or updates.
2. Affected System/Service - The specific system or service affected by the vulnerability (e.g., the URL of the vulnerable web page, the name of the mobile application).
3. Detailed Description of the Vulnerability - A clear and concise description of the vulnerability, including the type of vulnerability (e.g., Cross-Site Scripting, SQL Injection, Remote Code Execution).
4. Steps to Reproduce - Detailed steps that we can follow to reproduce the vulnerability. This should include specific inputs, requests, and responses.
5. Proof of Concept (PoC) - If possible, provide a proof of concept demonstrating the vulnerability. This could be a screenshot, or a video no links.
6. Potential Impact - A description of the potential impact of the vulnerability.
7. Supporting Materials - Any other relevant information, such as screenshots, logs, or network captures.

Our Commitment

Upon receiving a vulnerability report, we commit to the following:

1. Acknowledgment - We will acknowledge receipt of your report within 3 business days.
2. Investigation - We will investigate the reported vulnerability and take appropriate action to validate and address it.
3. Communication - We will keep you informed of the progress of our investigation and resolution efforts, within reasonable time frames.
4. Confidentiality - We will keep your report confidential and will not disclose your identity without your explicit permission, unless required by law.
5. Responsible Disclosure - We request that you refrain from publicly disclosing the vulnerability until we have had a reasonable opportunity to investigate and address it. We typically request a 30 day coordinated disclosure window, but this can be adjusted on a case-by-case basis.
6. No Legal Action - We will not initiate legal action against individuals who report vulnerabilities in good faith and in accordance with this Policy.

Out of Scope Vulnerabilities and Activities

The following activities are considered out of scope and are not covered by this policy:

1. Performing actions that could negatively impact our users or services (e.g., data exfiltration, denial-of-service attacks).
2. Accessing or attempting to access data or systems that do not belong to you.
3. Exploiting a vulnerability for any purpose other than reporting it to us.
4. Publicly disclosing a vulnerability before we have had a reasonable opportunity to address it.
5. Violating any applicable laws or regulations.

"While we appreciate all responsible disclosures, we currently do not offer a bug bounty program."

Changes to this Policy

We reserve the right to modify this Policy at any time. Any changes will be posted on this page.

Contact Us

If you have any questions about this Policy, please contact us at [email protected].

We appreciate your cooperation in helping us maintain the security of our systems and services.