Vulnerability disclosure policy.

Feith Systems is dedicated to upholding the highest standards of data protection and information security for our clientele. This policy delineates the framework for ethical vulnerability research within our digital environments: clear directives for security experts, and the protocol for reporting what they find.

It specifies the systems and research types covered, the process for submitting a report, and the timeframe we ask researchers to allow before any public disclosure. We strongly encourage you to engage with our team to disclose potential vulnerabilities identified within our infrastructure.

Authorization

If your security research is conducted in compliance with this policy, it is deemed authorized. We pledge to collaborate with you to understand and remediate the issue expeditiously.

Feith Systems commits to not initiating or endorsing legal proceedings related to research conducted under this policy. In the event of third-party legal action arising from your policy-abiding activities, we will affirm that authorization.

Guidelines

Within this framework, "research" means activities in which you:

• Promptly inform us upon identifying a real or potential security issue.
• Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Use exploits only to the extent necessary to confirm a vulnerability. Do not compromise data, establish persistent access, or move laterally to other systems.
• Give us a reasonable time to resolve the issue before disclosing it publicly.
• Do not submit a high volume of low-quality findings.

If you encounter a vulnerability or sensitive data (including personal, financial, or proprietary information), stop testing immediately, notify us, and do not share the information further.

Prohibited testing

• Network denial of service (DoS or DDoS), or any activity that impairs access to, or the integrity of, systems and data.
• Physical intrusion attempts, social engineering (phishing, vishing), or other non-technical assessments.

Scope

Services not explicitly designated (including third-party services) are outside this policy's scope and not authorized for testing. For vulnerabilities in our partners' or clients' systems, report directly to them. Unsure whether a system is in scope? Ask us at it-sec@feith.com before you begin.

While we operate numerous web-accessible platforms, this policy restricts active investigation to the designated systems. If you believe an out-of-scope system warrants examination, please discuss it with us first.

Reporting a vulnerability

Submissions under this policy are for remediation purposes only. Where findings have broader implications, we may coordinate with the Cybersecurity and Infrastructure Security Agency (CISA) under their vulnerability disclosure protocol. Your personal details remain confidential unless you give explicit consent to disclose them.

Report vulnerabilities to it-sec@feith.com. Anonymous submissions are welcome. If you provide contact details, expect an acknowledgment within three business days.

We value reports that

• Specify the vulnerability's location and potential impact.
• Detail the steps to reproduce it (scripts or screenshots help).
• Are written in English, where possible.

What to expect from us

• An acknowledgment within three business days.
• Transparency throughout verification and resolution.
• Ongoing communication about remediation progress.

Inquiries

For questions or suggestions to improve this policy, contact it-sec@feith.com. We welcome your feedback and aim to improve this policy continually.