Security and responsible disclosure

If you have found a security weakness in nooryva.com, we want to hear about it, and this page tells you how to tell us and what we will do about it. Reports are read by a person.

How to report something

Write to admin@nooryva.com. Please include enough for us to reproduce it: the address of the page, what you did, what happened, and anything else we would need. A short proof of concept is worth more than a scanner’s report.

The same details are published in machine-readable form at /.well-known/security.txt, which is the file automated tools and researchers look for first.

What we promise you

• We will acknowledge your report within three working days.
• We will tell you within ten working days whether we have confirmed it, and what we intend to do.
• We will keep you informed while we fix it, and tell you when the fix is live.
• We will credit you by name when we announce the fix, if you would like us to, and stay silent about you if you would not.
• We will not take legal action against you, and will not ask anybody else to, for research carried out in good faith under this policy.

What we ask of you

• Give us a reasonable chance to fix it before you tell anybody else. Ninety days is the usual window, and we will normally be much faster.
• Use only your own accounts and your own test data.
• Do not access, change or delete anybody else’s information. If you stumble upon somebody’s personal data, stop, and tell us what you found without keeping a copy.
• Do not degrade the service for anybody else. No denial of service, no load testing, no automated scanning heavy enough to be felt.
• Do not use social engineering, phishing, or physical attempts against our staff or our offices.

What is in scope

This website, its administrative area, and the endpoints they use. Anything that lets somebody read or change data they should not, take over an account, run code, or inject content into a page is worth reporting.

What is out of scope

These are reported to us often and are not, on their own, findings we will act on:

• missing security headers with no demonstrated exploit;
• output from an automated scanner without a working proof of concept;
• weaknesses that need a victim to already have malware, or physical access to their unlocked machine;
• email configuration opinions unaccompanied by an actual spoofed message;
• rate limiting on pages that do nothing, and version numbers disclosed without a matching exploit;
• anything affecting only browsers that are no longer supported by their maker.

We do not pay bounties

We are a trading house, not a technology company, and we do not run a paid bug bounty. We say so here rather than let you find out after the work. What we do offer is a fast, honest answer from a person, credit if you want it, and a promise not to come after you.

How this site is defended

For the sake of anyone assessing us as a supplier: everything travels over an encrypted connection. Administrative access requires a password and a second factor. Credentials held inside the system are encrypted where they sit. Every content change is logged against the administrator who made it. Forms are rate-limited and defended against automated abuse. Network addresses are stored only as one-way fingerprints, never in the clear. The site loads no third-party scripts, which removes an entire class of supply-chain risk.

If something goes wrong anyway

If a breach ever puts your information at risk, we will tell you and the relevant authority without delay, say plainly what happened and what it means for you, and not wait until we have a comfortable form of words. What we hold about you in the first place is set out in the privacy policy.

Which language applies

This policy is published in every language this site is published in. If the versions disagree, the English version applies.