Introduction

Floin, a leading cryptocurrency platform based in Liechtenstein, is dedicated to ensuring the security and integrity of its systems and user data. This Vulnerability Disclosure Policy provides a structured approach for security researchers to report potential vulnerabilities, ensuring they are addressed promptly and effectively.

Please note that this page does not provide any form of indemnity for any actions if they are either in breach of the law or of this policy. It does not provide an indemnity from Floin or any third party.

Scope

This policy applies to the following systems and services:

  • All publicly accessible websites and applications managed by Floin.

  • Subdomains associated with these primary domains unless explicitly excluded.

  • Systems explicitly mentioned as in-scope in this document.

  • "In scope" vulnerabilities must be original, previously unreported, and not already discovered by internal procedures.

Out of Scope

The following are out of scope for this policy:

  • Denial of Service (DoS) attacks.

  • Physical testing, such as office access, social engineering (e.g., phishing), and any other non-technical vulnerability testing.

  • Systems not explicitly listed as in-scope

  • Reports of non-exploitable vulnerabilities, or reports indicating that our services do not fully align with "best practice", for example missing security headers, are not in scope.

Reporting Process

1. Contact Information: Vulnerability reports should be submitted to:

2. Required Information: Your report should include:

  • A detailed description of the vulnerability and its potential impact.

  • Steps to reproduce the issue.

  • Relevant screenshots or evidence.

  • Your contact information for follow-up.

Safe Harbor

Floin commits to not pursuing legal action against researchers who:

  • Make a good faith effort to comply with this policy during their research.

  • Avoid privacy violations, degradation of user experience, and disruption to production systems.

  • Provide Floin with a reasonable amount of time to resolve the issue before Floin publicly discloses it (if at all, as decided in Floin’s sole discretion as may be required for security reasons). In no case are you allowed to publicly disclose a vulnerability.

Response and Remediation

Upon receiving a vulnerability report, Floin will:

1. Acknowledge receipt of the report within three (3) business days.

2. Handle your report with strict confidentiality

3. Provide regular updates on the status of the vulnerability as it is being assessed and remediated.

4. Work to fix the vulnerability in a timely manner.

5. Process the personal data that you provide (such as your e-mail address and name) in accordance with the applicable data protection legislation and will not pass on your personal details to third parties without your permission.

6. Publish your name as the discoverer of the problem, if you have agreed to this in your initial e-mail, when and if we disclose the problem publicly.

Guidelines

When conducting your operations, it is important that you...

  • do not take advantage of the vulnerability or problem you have discovered, for example by downloading more data than necessary to demonstrate the vulnerability, deleting, or modifying other people’s data

  • only use harmless exploits to confirm that a vulnerability is present

  • do not reveal any data downloaded during the discovery to the public or any other parties

  • do not reveal the vulnerability or problem to the public or other parties until it has been resolved and you have written confirmation to do so by Floin

  • stop your tests when you discover any sensitive information (Personally Identifiable Information – PII, medical, financial, proprietary information, or trade secrets) and notify us immediately, and do not disclose any obtained data to anyone else

You should never…

  • place malware (virus, worm, Trojan horse, etc.) on any system

  • compromise any systems using exploits to gain full or partial control

  • copy, modify or delete data from the system

  • make changes to the system

  • repeatedly access the system or share access with the public other parties

  • use any access obtained to attempt to access other systems

  • change access rights of other users

  • use automated scanning tools

  • use a so-called "brute force" attack to access any systems

  • use denial-of-service or social engineering (phishing, vishing, spam, etc.)

  • use attacks on physical security

We ask you to delete securely any and all data retrieved during your research as soon as it is no longer required or within 1 month of the vulnerability being resolved, whichever occurs first.

Legal and Compliance

Floin ensures that all reports will be handled in compliance with applicable laws and regulations. Researchers acting in good faith are assured protection under this policy.

Contact

For any questions regarding this policy or the reporting process, please reach out to: