Vulnerability Disclosure Policy

The AUIB Society of Arts and Letters is committed to keeping the personal data on its platforms safe. This policy, based on the template of the US Cybersecurity and Infrastructure Security Agency (CISA), tells security researchers what systems they may test, how to test them, and how to send the Society what they find. We encourage you to contact us with any weakness you discover.

Authorization

If you make a good-faith effort to follow this policy during your research, the Society will consider your research authorized, will work with you to understand and resolve the issue quickly, and will not recommend or pursue action against you. If a third party takes legal action against you for activity that followed this policy, the Society will make this authorization known. This authorization covers only the Society’s own systems listed under Scope; it does not authorize anything that the University’s policies or the law forbid on the University’s own systems.

Guidelines

Under this policy, research means activities in which you:

• tell us as soon as possible after you find a real or possible security issue;
• make every effort to avoid violating privacy, degrading anyone’s experience, disrupting the service, or destroying or changing data;
• use exploits only as far as needed to confirm that a weakness exists, and do not use one to reach, change or delete data, set up lasting access, or move to other systems;
• give us reasonable time to fix the issue before you tell anyone else;
• do not submit a large number of low-quality reports.

Once you have confirmed a weakness, or if you come across personal data, financial information, or anything private or confidential, stop testing, tell us at once, and do not share the data with anyone else.

Test methods

The following are not authorized: denial-of-service testing; physical testing (such as office access or tailgating); social engineering, including phishing, against members, staff, or anyone else; and any other testing of the Society’s people.

Scope

• auibsal.org, including the Diwan (auibsal.org/diwan), the partner dashboard, and the API (auibsal.org/api)
• Hudhud, the Society’s Telegram bot (@auibsal_bot)
• The Society’s emails, sent from auibsal.org and news.auibsal.org

Any service not listed is out of scope, including status.auibsal.org and the platforms the Society uses (such as Vercel, Supabase, Resend, Cloudflare, Zoho, Notion, Telegram, and Google), which have their own disclosure programs, and every University system. If you are unsure whether a system is in scope, ask us first.

Reporting a vulnerability

Write to security@auibsal.org; auibsal.org/.well-known/security.txt gives the same contact. You may report anonymously. Please tell us where the weakness was found, what it could affect, and how to reproduce it (a proof of concept or screenshots help). Please do not include anyone else’s personal data.

What you can expect from us

• We acknowledge your report within three business days.
• We confirm whether the weakness exists, and keep you informed as we fix it.
• If a breach of personal data has happened, we tell the people affected and Student Life within 72 hours of knowing, as the Policy Manual (SAL-GOV-03, Art. VIII) sets out.
• We credit you by name, if you wish, once the fix is in place.

Questions

Questions about this policy go to security@auibsal.org. We also welcome suggestions for improving it.