Vulnerability Disclosure Policy

In scope

Only the production hosts above are in scope. If you are unsure whether an asset belongs to 1Centre or is in scope, ask us at the contact address below before testing.

Out of scope

• Any host not listed above, including internal service endpoints and non-production environments.
• Third-party services we use (for example payment, email delivery, customer-support and cloud-hosting providers). Please report issues in those services to the vendor directly.
• Accounts, applications or data belonging to other 1Centre customers.
• Physical security of 1Centre offices or staff.

Findings we generally do not accept

The following are usually not treated as vulnerabilities unless you can show a concrete security impact:

• Results from automated scanners without a demonstrated, reproducible issue.
• Missing security headers, cookie flags or TLS configuration best practices with no exploitable impact.
• Clickjacking on pages with no sensitive actions.
• Self-XSS, or issues that require the victim to paste code into their own browser.
• CSRF on logout or other actions with no security impact.
• Rate-limiting or brute-force reports without a demonstrated account takeover.
• User / email enumeration with no further impact.
• Vulnerabilities in outdated browsers or platforms.
• Email spoofing / SPF / DMARC policy observations.
• Reports that require physical access to a user's unlocked device.

Email support@1centre.com with:

• A description of the vulnerability and its potential impact.
• The affected URL(s), endpoint(s) or component(s).
• Step-by-step instructions to reproduce, including any proof-of-concept code, request / response samples or screenshots.
• Your name or handle (optional) and how you would like to be credited, if at all.

Please do not include real customer personal data in your report. If you accidentally obtained any, tell us what it was and delete it (see section 4).

We accept reports in English.

Remediation targets follow 1Centre's internal Operations Security Policy:

1Centre determines the final severity using its own knowledge of the architecture and the real-world exploitability of the issue, which may differ from the severity you suggest. Where an issue cannot be fixed within the target, we will keep you informed of progress.

We will treat your report confidentially and will not share your personal details outside 1Centre without your permission, unless required by law.

When investigating and reporting, you must:

• Only test against accounts you own or that you have explicit permission to use.
• Stop testing and report immediately once you have confirmed a vulnerability. Use the minimum access necessary to demonstrate the issue.
• Not access, modify, download, delete or retain data belonging to other users or customers. If you inadvertently access such data, stop, do not share it, delete any copies, and tell us in your report.
• Give us a reasonable time to remediate before any public disclosure, and coordinate the disclosure date with us.

You must not:

• Perform denial-of-service or load testing, or any action that degrades the availability of our services.
• Use social engineering, phishing, pretexting or vishing against 1Centre staff, customers or vendors.
• Attempt physical access to 1Centre offices or equipment.
• Use automated scanners at a volume that affects service performance, or send spam / unsolicited messages through our platform.
• Pivot from a found vulnerability to other systems, establish persistence, or install malware or backdoors.
• Demand payment or other compensation in exchange for not disclosing a vulnerability.
• Violate any applicable law.

This is a vulnerability disclosure programme, not a paid bug bounty. 1Centre does not offer monetary rewards for reports. With your permission, we may publicly thank researchers who report valid, previously unknown vulnerabilities in line with this policy.

We may update this policy from time to time. The current version is always available at https://www.1centre.com/security/vulnerability-disclosure.