Native Teams
Pricing
Log inTalk to an expert
← Legal & Compliance

Vulnerability disclosure policy

Last updated:

Native Teams designs, builds and operates digital platforms that businesses and individuals rely on every day. We invest continuously in the security of our products, but we know that no system is perfect, and that independent security researchers play an important role in helping technology companies find and fix weaknesses. This Policy explains how to report a potential vulnerability to us and the rules we ask researchers to follow.

If you believe you have found a security vulnerability in one of our products, we want to hear from you. We will work with you in good faith to understand the issue and resolve it quickly.

What this Policy covers

This Policy applies to security vulnerabilities in the products and systems that Native Teams owns and operates.

In scope

  • Our website at nativeteams.com and its subdomains operated by Native Teams.
  • The Native Teams web application at app.nativeteams.com.
  • The Native Teams mobile applications for iOS and Android.
  • Application programming interfaces operated by Native Teams.

Out of scope

  • Websites, products and services operated by third parties, including our banking, payment, card, identity verification and cloud infrastructure partners. Please report vulnerabilities in those services directly to the provider concerned.
  • Social engineering, phishing or any attempt to deceive our team members, clients or users.
  • Physical attacks against our offices, data centres or equipment.
  • Denial-of-service attacks, load testing, or any testing that degrades the availability of our services.
  • Findings from automated scanners that are not accompanied by evidence of a real, exploitable security impact.
  • Missing security headers, cookie flags or best-practice configurations without a demonstrable security impact.
  • Issues that require physical access to a user's device, or that only affect outdated or unsupported browsers and operating systems.
  • Vulnerabilities that have already been reported to us or are already known.

Rules of engagement

To protect our users and their information, we ask everyone who researches the security of our products to follow these rules. Following them is a condition of the safe harbour described later in this Policy.

Please

  • Test only against accounts that you own, or that you have the explicit permission of the account holder to use.
  • Stop as soon as you have confirmed a vulnerability, and use the minimum amount of access needed to demonstrate it.
  • Report the vulnerability to us promptly, and give us a reasonable amount of time to fix it before sharing any information about it publicly.
  • Keep the details of the vulnerability confidential until we have confirmed that it has been resolved, or until we have agreed a disclosure date with you.
  • Comply with all applicable laws.

Please do not

  • Access, download, modify or delete data that belongs to other users, or attempt to view more data than is necessary to demonstrate the issue.
  • Attempt to move funds, make payments, change account details or carry out any financial transaction that you are not entitled to make.
  • Run tests that could disrupt, degrade or damage our services, our systems or the experience of our users.
  • Use a vulnerability to gain further access to our systems, or to pivot to other systems.
  • Demand payment or any other benefit in exchange for information about a vulnerability.

What if I come across personal data?

If you encounter personal data, financial information or other confidential information during your research, please stop immediately, do not save, copy or share it, and tell us in your report. Once the issue has been reported, please securely delete any such information that you may hold.

How to report a vulnerability

Please send your report by email to security@nteams.com. If you would like to encrypt your report, contact us at the same address and we will provide a secure method of sharing it. You can report anonymously if you prefer, but providing contact details allows us to ask questions and keep you informed.

A good report includes

  • A description of the vulnerability and the product, page or endpoint where you found it.
  • Clear steps to reproduce the issue, including any requests, parameters or code used.
  • The potential impact, and what an attacker could achieve by exploiting it.
  • Screenshots, videos or other evidence that help us confirm the issue.
  • Your contact details, if you would like us to keep you updated or to credit you.

Please write your report in English if you can, and send one report for each vulnerability, unless several issues need to be combined to demonstrate an impact.

What you can expect from us

We take every report seriously, and we aim to keep you informed at every stage.

Our commitments

  • Acknowledgement. We will acknowledge your report within three business days.
  • Assessment. We will review your report, confirm whether we can reproduce the issue, and share our initial assessment within ten business days.
  • Updates. We will keep you informed of our progress while we work on a fix, and let you know when the issue has been resolved.
  • Resolution. We will prioritise fixes according to the severity of the issue and the risk to our users, and work to resolve confirmed vulnerabilities as quickly as possible.

Coordinated disclosure

We believe that vulnerabilities should be disclosed in a coordinated way that protects users. We ask that you do not share information about a vulnerability publicly until we have resolved it and agreed a disclosure date with you. We aim to resolve confirmed vulnerabilities within ninety days of the report. If a fix requires more time, we will explain why and agree a revised timeline with you. Where a vulnerability affects our clients or users, we will inform them as appropriate.

Safe harbour

We consider security research carried out in good faith and in accordance with this Policy to be authorised. If you follow this Policy, we will not pursue legal action against you, or ask law enforcement to investigate you, in connection with your research. If a third party takes legal action against you for activity that was carried out in accordance with this Policy, we will make it known that your actions were authorised by us.

This safe harbour applies only to our own products and systems, and it cannot authorise research on systems operated by third parties. If you are unsure whether your planned research is consistent with this Policy, please contact us before you begin.

Rewards

Native Teams does not currently operate a paid bug bounty programme, and we do not offer monetary rewards for reports. We are genuinely grateful to the researchers who help us keep our products secure.

Contact us

For security reports, please contact security@nteams.com. For other questions about security at Native Teams, please see our Security Posture page, and for questions about personal data, our Talk to Data Protection page.