Responsible disclosure
Security is what we do, so we want to hear about any weakness in Frontage. This policy explains how to report one, what you may and may not test, and what you can expect from us. It also explains how we handle vulnerabilities we find in other people’s systems.
Part A: Reporting a vulnerability in Frontage
Authorization and safe harbor
If you make a good-faith effort to comply with this policy during your security research, we will consider your research to be authorized under the Computer Fraud and Abuse Act and similar state laws (including Chapter 76 of Title 18 of the Pennsylvania Consolidated Statutes), we will not initiate or support legal action against you, and we waive any restriction in our Terms of Service that would otherwise prohibit the research, solely to the extent of activities conducted under this policy. If a third party starts legal action against you for activities that complied with this policy, we will make it known that your actions were authorized by us.
Limits. We can authorize testing only of systems we own and control. We cannot authorize access to systems or data belonging to our customers, our service providers or anyone else, and this policy does not bind law enforcement or third parties. If you are unsure whether something is consistent with this policy, ask us at security@frontagesecurity.com before going further.
Scope
In scope: our website and service at frontagesecurity.com and its subdomains, including the sign-in, registration, customer portal and billing pages.
Out of scope:
- our providers’ systems, such as Stripe’s checkout and billing pages and Cloudflare’s network (report those to them);
- our customers’ systems and anything we scan for them;
- physical testing and social engineering of our staff or customers;
- denial of service and volume testing; and
- complaints about traffic from our scanner, which go to abuse@frontagesecurity.com (see our scanning traffic).
Rules
- Test only with an account you created yourself. If you need a second account to test separation between customers, ask us and we will set one up.
- Stop at a proof of concept. If you encounter data that is not yours, such as another customer’s findings or any personal data, stop, do not keep or share it and tell us immediately.
- Do not degrade the service: no denial of service, no high-volume automated scanning, no spam or phishing.
- Do not pivot from a weakness to other systems or try to keep access.
- Report promptly and keep details confidential until we agree they can be disclosed.
How to report
Email security@frontagesecurity.com with the affected address, the steps to reproduce the issue, what you believe its impact is and any proof of concept. Anonymous reports are welcome. Please do not include other people’s data.
What you can expect from us
- Acknowledgment within 3 business days.
- An initial assessment within 10 business days, and updates at least every 30 days until the issue is resolved.
- Coordinated disclosure: we ask you to wait until the issue is fixed, or 90 days from your report, whichever comes first, before publishing. We may agree to a different timeline with you, for example, if a fix needs longer or the issue is being actively exploited.
- Credit, with your permission, once the issue is fixed. We do not currently pay rewards.
Your data
Do not keep, share or disclose any data you accessed during your research. Delete it once you have sent your report and keep the details confidential until coordinated disclosure.
Part B: Vulnerabilities we find in other systems
In our customers’ systems
Findings about a customer’s systems are that customer’s confidential information. We report them only to the customer and the people it designates, and never publish them, use them in a case study or share them in a way that identifies the customer without its written consent. Urgent issues, such as signs of an active compromise, an exposed database or leaked credentials, go promptly to the customer’s emergency contact. We do not tell a customer’s vendors, regulators or law enforcement unless the customer agrees or the law requires it. We may publish aggregated statistics that identify no customer, person or system.
In systems that turn out not to be our customer’s
If a target turns out to belong to someone else, we stop active testing, keep only what we need and tell the customer. Only where we see a serious and imminent risk will we consider alerting the real owner through its published security contact, or a national computer emergency response team, without naming our customer.
In third-party products
If we discover a vulnerability in software or a service used by many organizations, we report it privately to its vendor through the vendor’s published security contact, escalate to CERT/CC or CISA if the vendor does not respond and follow a default 90-day coordinated disclosure timeline, adjusted where a flaw is being actively exploited. We never include details that identify a customer without its consent.
Colin Finley, doing business as Frontage Security · contact@frontagesecurity.com