Vulnerability Disclosure Policy
Last updated: 22. October 2024
Last updated: 22. October 2024
Floin, a leading cryptocurrency platform based in Liechtenstein, is dedicated to ensuring the security and integrity of its systems and user data. This Vulnerability Disclosure Policy provides a structured approach for security researchers to report potential vulnerabilities, ensuring they are addressed promptly and effectively.
Please note that this page does not provide any form of indemnity for any actions if they are either in breach of the law or of this policy. It does not provide an indemnity from Floin or any third party.
This policy applies to the following systems and services:
All publicly accessible websites and applications managed by Floin.
Subdomains associated with these primary domains unless explicitly excluded.
Systems explicitly mentioned as in-scope in this document.
"In scope" vulnerabilities must be original, previously unreported, and not already discovered by internal procedures.
The following are out of scope for this policy:
Denial of Service (DoS) attacks.
Physical testing, such as office access, social engineering (e.g., phishing), and any other non-technical vulnerability testing.
Systems not explicitly listed as in-scope
Reports of non-exploitable vulnerabilities, or reports indicating that our services do not fully align with "best practice", for example missing security headers, are not in scope.
1. Contact Information: Vulnerability reports should be submitted to:
Floin Security Team: security@floin.com
2. Required Information: Your report should include:
A detailed description of the vulnerability and its potential impact.
Steps to reproduce the issue.
Relevant screenshots or evidence.
Your contact information for follow-up.
Floin commits to not pursuing legal action against researchers who:
Make a good faith effort to comply with this policy during their research.
Avoid privacy violations, degradation of user experience, and disruption to production systems.
Provide Floin with a reasonable amount of time to resolve the issue before Floin publicly discloses it (if at all, as decided in Floin’s sole discretion as may be required for security reasons). In no case are you allowed to publicly disclose a vulnerability.
Upon receiving a vulnerability report, Floin will:
1. Acknowledge receipt of the report within three (3) business days.
2. Handle your report with strict confidentiality
3. Provide regular updates on the status of the vulnerability as it is being assessed and remediated.
4. Work to fix the vulnerability in a timely manner.
5. Process the personal data that you provide (such as your e-mail address and name) in accordance with the applicable data protection legislation and will not pass on your personal details to third parties without your permission.
6. Publish your name as the discoverer of the problem, if you have agreed to this in your initial e-mail, when and if we disclose the problem publicly.
When conducting your operations, it is important that you...
do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability, deleting, or modifying other people’s data
only use harmless exploits to confirm that a vulnerability is present
do not reveal any data downloaded during the discovery to the public or any other parties
do not reveal the vulnerability or problem to the public or other parties until it has been resolved and you have written confirmation to do so by Floin
stop your tests when you discover any sensitive information (Personally Identifiable Information – PII, medical, financial, proprietary information, or trade secrets) and notify us immediately, and do not disclose any obtained data to anyone else
You should never…
place malware (virus, worm, Trojan horse, etc.) on any system
compromise any systems using exploits to gain full or partial control
copy, modify or delete data from the system
make changes to the system
repeatedly access the system or share access with the public other parties
use any access obtained to attempt to access other systems
change access rights of other users
use automated scanning tools
use a so-called "brute force" attack to access any systems
use denial-of-service or social engineering (phishing, vishing, spam, etc.)
use attacks on physical security
We ask you to delete securely any and all data retrieved during your research as soon as it is no longer required or within 1 month of the vulnerability being resolved, whichever occurs first.
Floin ensures that all reports will be handled in compliance with applicable laws and regulations. Researchers acting in good faith are assured protection under this policy.
For any questions regarding this policy or the reporting process, please reach out to:
Floin Security Team: security@floin.com