Responsible Disclosure Policy

01. Introduction & Corporate Identity

This Responsible Disclosure Policy ("Policy") sets out the guidelines, scope, and rules of engagement for security researchers, clients, and members of the public who wish to report security vulnerabilities affecting KHODSHIMA SUMN ASSIST LTD ("Company", "we", "us", or "our"), a private limited company incorporated in England and Wales under company registration number 17435961, with its registered office at 128 City Road, London, United Kingdom, EC1V 2NX.

The Company takes the security of its website, digital infrastructure, and client-facing systems seriously. We recognise that independent security researchers play a vital role in maintaining a safer digital ecosystem. This Policy provides a framework for responsible vulnerability disclosure that protects both the Company and the researcher, in accordance with industry best practices and the Computer Misuse Act 1990.

02. Scope

This Policy applies to security vulnerabilities identified in the following Company-owned assets:

• Company Website: khodshimasumnassistltd.com and all subdomains;
• Web Application: Next.js frontend, API routes, server-side rendering endpoints, and authentication mechanisms;
• Client Portal: Any authenticated areas where clients access deliverables, download links, or service reports;
• Payment Integration: The Stripe and Airwallex checkout flows as implemented on the Company website (note: payment provider infrastructure itself is out of scope — report directly to Stripe or Airwallex);
• Email Infrastructure: Company email systems used for client communication and deliverable delivery;
• DNS & TLS Configuration: DNS records, TLS certificates, and security headers associated with Company domains.

Out of scope:

• Third-party SaaS platforms used by the Company (e.g., GitHub, cloud providers) — report to the respective platform's security team;
• Client-owned server infrastructure that the Company has hardened as part of a service engagement — vulnerabilities in client systems should be reported to the client;
• Vulnerabilities in open-source tools referenced in deliverables (CIS, Lynis, OWASP) — report to the respective project maintainers;
• Social engineering, phishing, or physical security attacks against Company personnel;
• Denial of Service (DoS/DDoS) attacks of any magnitude;
• Automated scanner reports without manual verification or proof of concept.

03. Rules of Engagement

To qualify for safe harbour protection under this Policy, researchers must adhere to the following rules:

• Authorised Testing Only: Test only the systems listed in Section 2. Do not access, probe, or scan systems that you do not own or are not explicitly in scope;
• No Data Exfiltration: Do not access, copy, modify, or delete data that does not belong to you. If you inadvertently access sensitive data, do not download, store, or share it — report it immediately and delete any local copies;
• No Persistence: Do not install backdoors, persistent access mechanisms, or malware on Company systems;
• No Disruption: Do not attempt to cause service degradation, denial of service, or disruption to Company operations or client services;
• No Social Engineering: Do not attempt to phish, pretext, or socially engineer Company personnel, clients, or suppliers;
• No Physical Intrusion: Do not attempt to gain physical access to Company offices, data centres, or hardware;
• Privacy Respect: Do not access personal data of other users, clients, or Company personnel. If personal data is inadvertently exposed, report it without viewing or copying;
• Good Faith: All testing must be conducted in good faith with the intent to improve security, not to cause harm, embarrassment, or reputational damage to the Company;
• UK Law Compliance: All testing must comply with the Computer Misuse Act 1990, the Data Protection Act 2018, and all other applicable UK laws. Unauthorised access is a criminal offence regardless of intent.

04. Reporting a Vulnerability

Vulnerability reports should be submitted to info@khodshimasumnassistltd.com with the following information:

1. Summary: A clear description of the vulnerability and its potential impact;
2. Affected Asset: The specific URL, endpoint, or system component affected;
3. Steps to Reproduce: Detailed, step-by-step instructions to reproduce the vulnerability, including any prerequisites;
4. Proof of Concept: A minimal proof of concept (PoC) demonstrating the vulnerability. Do not include excessive data dumps or screenshots of personal data;
5. Impact Assessment: Your assessment of the severity and potential business impact;
6. Suggested Remediation: If available, your recommendations for fixing the vulnerability;
7. Researcher Details: Your name, email address, and any preferred acknowledgement handle (if you wish to be credited).

Reports should be submitted in English. The Company acknowledges receipt of all valid reports within 48 hours and provides an initial assessment within 5 business days.

05. Vulnerability Severity & Classification

The Company classifies reported vulnerabilities using the CVSS v3.1 (Common Vulnerability Scoring System) severity framework:

06. Safe Harbour & Legal Protection

The Company is committed to working with security researchers who act in good faith and in compliance with this Policy. Subject to the rules of engagement in Section 3, the Company provides the following safe harbour commitments:

• No Legal Action: The Company will not initiate legal proceedings against researchers who discover and report vulnerabilities in accordance with this Policy and applicable UK law;
• Computer Misuse Act 1990: The Company acknowledges that the Computer Misuse Act 1990 does not contain a statutory public interest defence. However, the Company commits to not reporting researchers to law enforcement where they have acted strictly within the scope of this Policy;
• No Bounty Programme: The Company does not currently operate a monetary bug bounty programme. Vulnerability reports are voluntary contributions to security improvement;
• Acknowledgement: With the researcher's consent, the Company will acknowledge their contribution in a public Hall of Fame section (where implemented) or in the security advisory published alongside the fix;
• Confidentiality: The Company will not disclose the researcher's identity without their explicit written consent;
• First Reporter Priority: Where multiple researchers report the same vulnerability, credit is given to the first valid report received.

07. Disclosure Timeline & Coordination

The Company follows a coordinated disclosure process:

1. Receipt (Day 0): The Company acknowledges receipt of the vulnerability report within 48 hours;
2. Triage (Day 1-5): The Company validates the vulnerability, assigns a CVSS severity rating, and confirms or disputes the finding. The researcher is notified of the triage outcome;
3. Remediation (Day 5-30): The Company develops and deploys a fix. The timeline depends on severity: Critical and High vulnerabilities are prioritised for remediation within 7-14 days; Medium and Low within 30 days. The researcher is kept informed of progress;
4. Verification (Post-Fix): The Company confirms the fix resolves the vulnerability. Where practicable, the researcher is invited to verify the remediation;
5. Public Disclosure (90 days): The Company commits to public disclosure of the vulnerability (if applicable) within 90 days of the initial report, or sooner if a fix is deployed and verified. The researcher is credited unless they prefer to remain anonymous;
6. Extension: If remediation requires more than 90 days, the Company will communicate the reasons and proposed timeline to the researcher. The researcher agrees not to publish details before the fix is deployed or before the 90-day deadline, whichever is earlier, unless the Company agrees to an earlier disclosure.

08. Prohibited Activities & Service Scope

Consistent with the Company's business model, this Policy does not authorise testing of any infrastructure associated with prohibited activities, including:

• Financial services, banking, or payment processing infrastructure (beyond the Company's own checkout integration);
• Cryptocurrency exchanges, wallets, or mining infrastructure;
• Gambling, betting, or adult content platforms;
• Any FCA-regulated activity or infrastructure;
• Any infrastructure located in or connected to sanctioned jurisdictions (Russian Federation, Belarus, Iran, North Korea, Syria, Cuba, occupied territories of Ukraine).

See our Terms & Conditions for the full list of prohibited activities.

09. Data Protection & UK GDPR

The Company processes researcher personal data (name, email address, communication history) in accordance with the UK Data Protection Act 2018 and UK GDPR. For details on how researcher data is collected, stored, and retained, see our Privacy Policy.

Key commitments to researchers:

• Researcher identity is kept confidential and shared only with personnel directly involved in vulnerability triage and remediation;
• Researcher data is retained for 12 months following resolution of the vulnerability, then permanently deleted unless the researcher consents to Hall of Fame acknowledgement;
• Researchers may exercise their data subject rights (access, rectification, erasure, objection) by contacting info@khodshimasumnassistltd.com.

10. Policy Amendments & Related Documents

This Policy may be updated to reflect changes in the Company's infrastructure, legal requirements, or industry best practices. Amendments are published on this page with an updated revision date. This Policy should be read in conjunction with:

• Privacy Policy — data protection and UK GDPR compliance;
• Terms & Conditions — prohibited activities and service scope;
• Compliance & Standards Overview — comprehensive compliance framework;
• Cookie Policy — PECR compliance and cookie usage.