This policy is published by Standard Intelligence Limited (company number 16737890, registered in England and Wales; registered office 128 City Road, London EC1V 2NX). We welcome reports of security vulnerabilities in our websites and services. If you believe you have found one, please tell us so we can fix it.
How to contact us
Email security@standardintelligence.com. Both of our founders receive every message sent to that address.
If your report holds sensitive detail, such as a working exploit, send a short summary first. We will then agree a secure way for you to send the rest.
What to include
- The service or web address affected.
- What the vulnerability is and what someone could do with it.
- Steps to reproduce it, with any proof of concept.
- Whether you believe it is being exploited.
- How we can reach you, if you want a reply.
Please do not include personal data belonging to anyone else. If a finding exposed personal data, describe the type of data and stop there.
What to expect from us
- We acknowledge your report within 5 working days. Within 10 working days we aim to assess how serious it is and tell you what we will do next.
- We tell you whether we can reproduce it and what we plan to do, and we keep you informed until it is resolved.
- We credit you publicly once it is fixed, if you want us to.
- We do not pay rewards, and we do not ask you to sign a non-disclosure agreement to report to us.
In scope
- standardintelligence.com, our other domains, and the subdomains we operate.
- The Standard Intelligence platform and its APIs.
Out of scope
- Services run by our suppliers. Please report those to the supplier. If you are not sure whether a problem is ours or a supplier's, report it to us.
- Denial-of-service testing, load testing and spam.
- Social engineering or phishing of our staff, and any physical testing.
- Reports generated by automated scanners without a demonstrated impact.
- Missing best-practice headers or settings with no demonstrated security impact.
Please do not
- Access, change or delete data that is not yours, or go further than needed to show the vulnerability.
- Disrupt our services or degrade them for other users.
- Share the vulnerability with others until we have fixed it, or until we have agreed a disclosure date with you.
If you reach any data while testing, keep it secure and do not share it. Delete it as soon as you no longer need it, and at the latest one month after we tell you the vulnerability is fixed.
Legal position
You may test the services in scope, in good faith and within this policy. If you do, we will not take legal action against you or report you to the police.
This policy follows common good practice for vulnerability disclosure. It does not permit you to break the law, or to act in a way that could put us or our suppliers in breach of a legal obligation.
Personal data
If your report shows that personal data may have been exposed, we treat it as a possible personal data breach. We assess it within 24 hours. Where the data is ours, we report it to the Information Commissioner's Office where the law requires. Where the data belongs to one of our customers, we tell that customer without undue delay, and within 48 hours at the latest. We help them decide whether the Information Commissioner's Office and the people affected must be told.
security.txt
We publish a security.txt file at https://www.standardintelligence.com/.well-known/security.txt, in the format set out in RFC 9116. It lets anyone find our reporting address. The file holds these fields:
| Field | Value | Required by RFC 9116 |
|---|---|---|
| Field Contact | Value A mailto link to our security email address | Required by RFC 9116 Yes |
| Field Expires | Value A date less than one year after publication. We renew the file before that date. The field appears once only. | Required by RFC 9116 Yes |
| Field Policy | Value The address of this policy on our website | Required by RFC 9116 No |
| Field Preferred-Languages | Value en | Required by RFC 9116 No |
| Field Canonical | Value The address of the security.txt file itself | Required by RFC 9116 No |
We serve the file over HTTPS as plain text in UTF-8. It has no Encryption field, because we hold no public encryption key for security reports. The file is not signed.