Reporting a security vulnerability

If you believe you have found a security vulnerability in one of our products or services, we want to hear about it.

How to report

Email security@saphe.dk. We will confirm receipt, and we will keep you informed as we investigate.

Please include as much of the following as you can:

• Which product, site, app or device is affected, and the version if you know it
• What you did, in enough detail such that we can reproduce it
• What you observed, and why you believe it is a security issue
• How we can reach you if we have any questions

This is not an invitation to test

We do not permit active vulnerability scanning or attempting to exploit our systems in any way. Our Terms and Conditions continue to apply, and we do not permit any breach of them. This policy exists so that if you have incidentally discovered a vulnerability while using our products, you have a safe way to tell us about it.

Good-faith research

We will not pursue or support legal action against anyone who complies with our Terms and Conditions and who:

• discovers a vulnerability in good faith and reports it promptly to us,
• does not exploit it beyond what is necessary to demonstrate that it exists,
• does not access, modify or copy data belonging to anyone else,
• does not degrade, disrupt or damage our services, and
• gives us a reasonable opportunity to fix the issue before disclosing it.

What is in scope

This policy covers Saphe's products and services, including:

• saphe.com and checkout.saphe.com
• the Saphe mobile applications
• Saphe devices and their firmware
• the public APIs used by the products above

What is out of scope

• Anything not listed above
• Services operated by third parties on our behalf
• Denial-of-service and load testing
• Social engineering of our staff, customers or partners
• Physical attacks against our premises, staff or hardware
• Output from automated scanners with no demonstrated impact
• Self-XSS, and missing headers or configuration observations without a demonstrated exploit path

What you can expect

We will acknowledge your report and tell you what we intend to do about it. We do not operate a bug bounty programme and cannot offer payment for reports.

We will coordinate the timing of any public disclosure with you, and we ask that you do not disclose the issue publicly before a fix is available.