Responsible disclosure

We're security researchers ourselves, so we take reports about our own systems seriously. If you believe you've found a vulnerability in a TechRS system, we want to hear from you.

This policy applies only to the TechRS systems listed under Scope. It explains how to report a vulnerability, what you can expect from us, and the protection we offer researchers who act in good faith. It does not authorize testing of any other system — including systems that belong to our clients.

How to report a vulnerability

Email [email protected] with the subject line “Security report”. Reports in English or Hebrew are equally welcome. Please include:

• a description of the vulnerability and its type (for example, stored XSS or IDOR);
• the affected URL, endpoint, parameter or component;
• step-by-step instructions to reproduce it;
• its impact — what an attacker could realistically achieve;
• a proof of concept, such as HTTP requests and responses, a script or screenshots;
• how you would like to be credited, or that you prefer to stay anonymous.

Please don’t include real user data beyond the minimum needed to demonstrate the issue, and redact anything else. If your report contains details you would rather not send by plain email, say so in a first message and we will agree on a secure way to share them.

What you can expect from us

• We aim to acknowledge your report within 3 business days.
• We will keep you updated while we validate the issue and work on a fix, and tell you when it is resolved. If we conclude that a report is out of scope or not a vulnerability, we will tell you why.
• Once the issue is fixed, we will credit you publicly if you wish.

Scope

In scope

• techrs.co.il
• www.techrs.co.il

This covers both language versions of the site and all of its features, including the vulnerability dashboard, the contact form, the newsletter, account sign-in and comments.

Out of scope

The following systems and activities are not covered by this policy and must not be tested:

• third-party services we use — including Cloudflare, our email and hosting providers, and HackerOne itself (please report issues in those services to their owners);
• any domain or system not listed under “In scope”, including systems that belong to our clients;
• social engineering or phishing of TechRS staff;
• physical attacks against our offices, staff or equipment;
• denial-of-service attacks, and volumetric, load or stress testing;
• spamming or brute-forcing our forms, including the contact, newsletter and sign-in forms.

We also don’t accept the following types of report:

• output from automated scanners without a demonstrated impact;
• missing best-practice HTTP security headers or cookie flags, without a demonstrated exploit;
• clickjacking on pages with no sensitive actions;
• self-XSS;
• cross-site request forgery (CSRF) on logout;
• disclosure of software versions, for example in banners or headers, without a working exploit.

Rules of engagement

• Test only against accounts you own. Public sign-up is currently closed, so if you need an account to test authenticated features, email us first. Never access another user’s account.
• Access or modify no more data than you need to demonstrate the issue, and stop as soon as you have. If you come across personal data, credentials or other sensitive information, don’t keep or share it, and tell us in your report.
• Don’t establish persistence: no backdoors, web shells or other footholds, and don’t use a vulnerability to move on to other systems.
• Don’t degrade the service for anyone else, and keep any automated testing to a low, reasonable rate.
• Keep the details confidential until we have fixed the issue or 90 days have passed since your report, whichever comes first, and coordinate any public disclosure with us.

Safe harbor

When you conduct vulnerability research in good faith and in accordance with this policy, we consider that research to be:

• authorized, including for the purposes of the Israeli Computers Law, 5755-1995, and similar laws elsewhere — we will not initiate legal action against you or refer you to law enforcement for it, including for accidental, good-faith violations of this policy;
• exempt from any restriction in our Terms of Use that would otherwise prohibit it — we waive those restrictions for this limited purpose;
• lawful, helpful to the overall security of the internet, and conducted in good faith.

You are still expected to comply with all applicable laws. If a third party initiates legal action against you over activity that complied with this policy, we will make it known that your actions were authorized under this policy.

We can only authorize research on systems we own. Third-party services, such as those listed under “Out of scope”, are governed by their owners’ policies. If at any point you are unsure whether your research is consistent with this policy, ask us at [email protected] before going further.

This section is adapted from the disclose.io core terms, published under CC0 1.0.

Rewards and recognition

We don’t currently run a paid bug bounty for our own site, so we can’t offer monetary rewards. We are glad, however, to thank researchers publicly — by name, handle or link, as you prefer — once the issue has been fixed.

security.txt

Our security contact details are also published in machine-readable form at /.well-known/security.txt, in line with RFC 9116.

We’re researchers too

TechRS hunts bugs in public bug-bounty programs — you can find us on HackerOne. We don’t run a program there for our own systems, so please send reports about TechRS by email, as described above.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed.