Back to home
NorthNorth OS

Vulnerability Disclosure Policy

Last Updated: 4 July 2026

North OS Technologies Ltd. ("North") welcomes reports from security researchers acting in good faith. This policy describes how to report vulnerabilities and what you can expect from us.

1. Scope

In scope: the North OS web application, APIs and official integrations operated by North.

Out of scope:

  • Third-party services and integrations we do not operate (report to the relevant vendor)
  • Social engineering, phishing or physical attacks against North staff or infrastructure
  • Denial-of-service testing or volumetric attacks
  • Spam, rate-limit exhaustion without security impact, or reports from automated scanners without a demonstrated vulnerability
  • Issues requiring physical access to a user's device

2. How to Report

Submit reports through the North website contact form with "Security Vulnerability" in the subject line, including:

  • A description of the vulnerability and its potential impact
  • Step-by-step reproduction instructions or proof of concept
  • Affected URLs, endpoints or components
  • Your contact details for follow-up

Please encrypt or minimise sensitive data in reports where possible.

3. Our Commitments

  • We will acknowledge your report within 5 business days.
  • We will keep you informed of progress and aim to remediate confirmed vulnerabilities on timelines proportionate to severity.
  • We will not pursue legal action against researchers who comply with this policy (safe harbour, Section 5).
  • With your consent, we are happy to credit you once the issue is fixed.

4. Rules of Engagement

While researching, you must:

  • Only test against accounts you own or have explicit permission to use
  • Not access, modify, delete or exfiltrate data belonging to other users — if you encounter another user's data, stop and report immediately
  • Not degrade the Service or harm users
  • Not publicly disclose the vulnerability before we have remediated it and agreed a disclosure timeline (we aim for coordinated disclosure within 90 days)
  • Comply with applicable law, including the UK Computer Misuse Act 1990 and the US Computer Fraud and Abuse Act, as modified by the authorisation granted in this policy

5. Safe Harbour

Security research conducted in good-faith compliance with this policy is considered authorised. We will not initiate legal action or law enforcement referral for such research, and we will make this authorisation known if a third party initiates action against you for activity covered by this policy.

6. No Bounty (Currently)

We do not currently operate a paid bug bounty programme. We deeply appreciate responsible disclosure and will acknowledge meaningful contributions.