Responsible Disclosure

Plauti considers the security of our systems a top priority. But no matter how much effort we put into system security, there can still be vulnerabilities.

If you discover a vulnerability, we would like to know about it so we can address it as quickly as possible. We ask you to help us better protect our clients and our systems.

Instructions

• E-mail your findings to disclosure@plauti.com.
• Do not take advantage of the vulnerability or problem you have discovered, for example, by downloading more data than necessary to demonstrate the vulnerability or deleting or modifying other people’s data.
• Do not reveal the problem to others until it has been resolved.
• Do not use attacks on physical security, social engineering, distributed denial of service, spam, or applications of third parties.
• Please provide sufficient information to reproduce the problem so we can resolve it as quickly as possible. Usually, the affected system's IP address or URL and a description of the vulnerability will be sufficient, but complex vulnerabilities may require further explanation.

Our promise

• We will respond to your report within five business days with our evaluation of the report and an expected resolution date.
• If you have followed the instructions above, we will not take any legal action against you in regard to the report.
• We will handle your report with strict confidentiality and not pass on your personal details to third parties without your permission.
• We will keep you informed of the progress toward resolving the problem.
• We strive to resolve all issues as quickly as possible.

Out of scope

• Any finding on our marketing website www.plauti.com
• Broken Link Hijacking
• Any type of Denial of Service attacks, and recommendations to mitigate these
• HTTP 404 codes/pages or other HTTP non-200 codes/pages and Content Spoofing/Text Injection on these pages
• Fingerprint version banner disclosure on common/public services
• Disclosure of known public files or directories or non-sensitive information (e.g. robots.txt)
• Clickjacking and issues only exploitable through clickjacking
• Lack of Secure/HTTPOnly flags on non-sensitive Cookies
• OPTIONS HTTP method enabled

anything related to HTTP security headers, e.g.:

• Strict-Transport-Security
• X-Frame-Options
• X-XSS-Protection
• X-Content-Type-Options
• Content-Security-Policy

SSL Configuration Issues:

• SSL forward secrecy not enabled
• Weak/insecure cipher suites
• SPF, DKIM, and DMARC issues
• Host header injection
• Reporting older versions of any software without proof of concept or working exploit
• Information leakage in metadata

Our so-called Responsible Disclosure Policy is not an invitation to actively scan our network or our systems for weaknesses. We monitor our networks and applications. Therefore, we are likely to pick up your scan, which our team will investigate.

PGP Code

If you want to send an encrypted message to disclosure@plauti.com, please use our PGP key. Find the complete key below:

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: Keybase OpenPGP v1.0.0
Comment: https://keybase.io/crypto

xsFNBGk76YcBEACwj1In/p9WJtMHwH60Rb5DaL1d2IG72CTwBmYocyhVTtSkZ1eG
wPS4FR8vreew9zgiMwf5oWS1GYenpuEgastthFoCbRyWxiK7pdeJSrRm2YMDYWMk
oyE1VEiq8rOaxLGkP+0A4YuiGbKWEEz/3RFZq+VrcG5Xn4DYUe6QwChAN3QhUy4U
xyrBKgyISrfnFwK9joCDMluNQpJF7MlhZjBXe8ryi+m6NFJVP0IQwI4Rk9PuWWVa
M7UAy9Z6AA8PPMeVJc/v2K3l+2bxGub7Ml9iv5aCNe2SyHAsYQFihI22NxAxcrfo
u2LkPdG0HJV1nc8nY+7jIZhfViUYDQMR05Sht30auZoY3xPIv+8cSqX6X7W0Tk76
UsCwScHyle/WPLwn6RRI/EI/Y0D3vESgBw6BFeng82vHT0IsSv1EqDngoAlF+TmV
/KF6XKjB08zmBKLfwCWoGsjh2+chjbxVrVdVtyP7n3hR+jrmMCXjiCwJmc7JkFum
GeCqYfhlIyzqdum0VFqw/SCU618Cgag5Pdn2MY+YM51+EcvZ7+C0eNsbrfR/VS4d
k+3DPFMHmhlqHdG0oaU+1z4el+gSfRvBgupMJLGkwPoEeGBQS5sPADv67xfzrAcA
oIRLn2wb/MKTkPTeTxxkzi5Xsj3F/ZcsyOzCFay8VFIqBCk5olXZsK6I4QARAQAB
zSxQbGF1dGkgU2VjdXJpdHkgVGVhbSA8ZGlzY2xvc3VyZUBwbGF1dGkuY29tPsLB
bQQTAQoAFwUCaTvphwIbLwMLCQcDFQoIAh4BAheAAAoJECjJFf46smcV8f4P/Rbb
KB/vFdENm3qHfWDM78G6sV/dL0z7LNL/yWQqLKXSaewFpBpPf83PbckmdQ5Z57C3
N9maK2sneCpunJb6RyrfB82u5gqBPjOk8Cc1BKIpRrkW8NKgvlblimaE288FBzmG
2gdLBu6IY8e5iHSRGmAiikEwCpJbz9jE1v9taZaQOU43oJb1x0zY7ijKUlivdvBp
GFA6TouhBeTTvIp2T5+kMXoaStUXRpWn5yZwxa3/T90g15kfs57L8+7XwTaXJrWT
cbq1XRXZQX3Zg5Che/5peYvKqYFe+uYueSinPthT3EXxLT7ZkimTnE6w6NFMOVPc
A6A0IE+OJHRatQ0s/LNp1EYZeLh5WgBbfD+i8/WT5CIeKlQqKE4GxZi+5FaNBNe0
qkPSg7uNvFXGiJotUmzTaofzseMsVrCrrTNHKV6SOjiI4VLx5UorVX+l2dx5baIE
dktMuA45M+QJ1lp/0XQGTDpDsDEL8GdWIjk/vrmnSDZSJu6myW5AGgNYnykWZ2Dy
wMr40JuKaG1BsU04UPd+8PsnPhrbE/HMszviu+JMiRfWZJ1eXf9B8ySvtQgJZ3RA
Rfl5GJcOAkPNYas5jF8HsM6Qyj2mktOAsjWN4jb5O5GqtT+8z6R5u5PfNN4Bggx2
cpEFSoi+wm0P+jHXCs564E9TR2p3VhmELRjJM3aazsFNBGk76YcBEACcNF34H1Ab
rnJYhdNk+tfvG4ncqIpHhdLh1WxASpSVmv6/IiIQETdS0TIRqGneVPCZc+15Cf1+
n2OyzEmaeExL0C+pN0hBtLAexNCUFk26FicYE+EcvHecd9+RexUXme8GIvtJKRdR
Is7R7e5eKSRvHZjFbnjLBL+Zcn+SPW6QcyEKgeJjXaAu5pCvuNCUFE5QJ93oTin9
Js+3E7HrzjEuK01/d8aJQEKD4tbuTks3V0MwqNrraq65MgyJm0y+NE1tYJ5FX3Kf
p2oshieyDiWBw/skste9pitL45cqL8m/OAOTtTTPvbDgqp8Ow9vYc8ga2TQJOfH/
Gsme6g68unBWjBHyn+BtzODDHLBZLHb/KgtaP+nFT/jYqJNop3NcthgEM38xWJZg
SPK6Tv8PIkobqbEWXOKd3e5Yr2a7f/iYkgXGo3p9cBuWvYmOeFHE26YPOz5gdbF8
SnOQGNGXI6sSgRwOdw1rfzR/Kgp9cwakSyodb8+MEMeGwGViU/kBs5FtEK8zGQ6V
Ol7ln4b9GaW7qxWHo4TY+qG4KTnrXXGMaPrlEYXoEebNQ0W0umEyKqWR7b5v/fjC
8D1sX36QBD9x+BxwnIMEQdARvS8wEM/Fi0nMONTVy1cZdNnqfO9+oIWWisT9NuqT
mg6XWsux/ZcxH07V/5XvWNO9NSO4u2ZJOQARAQABwsOEBBgBCgAPBQJpO+mHBQkP
CZwAAhsuAikJECjJFf46smcVwV0gBBkBCgAGBQJpO+mHAAoJEDvNH9zl7jo9w3YP
/2kwHEsE81UD7jGp9AS1iI25UiMJv7HjE4tQ9rNq8wcmkkPJsgiEkF/qvLqK2XyH
37EOBdQY1za0VlUIUwmubFV+gKg9S8+Y6Prw7atEcA3KXhfxCITBxSrzcp9xnd36
eNl4vcCp/nuF3Jbx4lbUQ0u3LV7KCXYA0dyZyfHq494YF40swT489s0on6FacpGP
naolyyAaZG/C6YCDgDG5ZCEXf39QgxImPUqVS09CLOIaEswaFJDlWuNFXoqey9QG
OSDZjJvsfDyjQhcTIdvWn8Z75No4timywkl9wtZM7Rwh7dSCuhLJbNp4QZmKP9FL
9O95/FXJcjK4Q7PxdQiTx5qID9i4+xlJgS2sZdosM24o4DC4+bhSGXp2zntDAIdh
fiNzZ0D8MJwwp9yoNcT+8+gb27KZiKMd+DLM21PFsrlzM7vWqlC+/L5A5FjXCAsg
XD+KTM0i2Vpr0s8tUtY+wwts/HuqvZ15tVbJZ8SPm5f91JZox6iNhlta9HtKBCul
rT+C8Q0zILYiLYUefCFgkvWxw6Rlt/P3GEBOoIaXfKhfDvTwbqu+eEHDOeW+RCCQ
lU/l+7HZnX6NmrdBZxsB6Ba/KftHoKyJi21x9ldcTGWqV1MMbXV8nYMJxF/n7D+I
NltaDD1JAIBeNfWqVGmyQqd7JBNAPSzY58+eDoJioCshxs8P/1gCBlI5wS3NgdWh
LQudklYu82M4O/J/29hQ7UX/9XCETlHf4sYjEhWxXkleWXJgbsOjnEJTro8qFKgn
TPdvYt3SZd+LA/TT7DWeahmTaP6L157T0D4E50pz/lEOhyVVlkWN897/IDzI5Ck5
1GViJpWzR0TBru20tDyf3hclFnWeebPqi3nGZl9vtA+ks2hlv8H0kMP6j513YiaA
h3LdOW1I48XXAdb8TfdSzw9TdkaHRkD+Al6IAMfKL6FoWLKtwd0Z8EVF2p9Y0oHa
H4A3IN3BemgfWB2ReWrhts9QfW7WnYKlwJR4eyGFHFdK236i3TKvcL1S4O0mYTx/
zFVzXZRMIDIASK+cq+zCMiTq/xMifNmSPxfBCIB56+Hpfy98iHwgn4EEQmosrskB
jxfpGlhKPyG9SNOr0ahqfdrM9/kN4aSrXzJ4TSh1L8gmi/MWOcJw9OPnAgtw4KQn
Ki7ja4SALrtEdYp2iq1EjIiilHPaWVFaEA1smT46IF9wXVF2l+TvaD1v4BwaSwAa
85XO8TdRKPRa1HzTwAe3eHgh3T2+8RwlJGlcuSvCLQ1rpYRSdAm86l0lJTeqGluP
w7GKawOuNN7n03Ubd7TTxPizutcnPDUFwmFNUinYlzkbGMGsYWhmbZRi+ZwMYyLo
3vB/1X79/kD30kltA1fhBm5IRF+4zsFNBGk76YcBEACtDXbIfDd8dkbElo6v5VNr
UCRhjVE2YzpP2g6wWahmlfArzDR/jr4qqggWsp3VPTm2Io9HItspHx83yqCBFKGd
WGRAxkpOp9sbG9Ctej7qhxq0mZItxUQGPUZ1E9XmZoYWFrJ7pkFuxE9/DsWa8X5f
RYFdu5a0grXpmDoO5bnIreFTOylriINwSxcjIYvqfzTnAwNWFYVMNAhQOebM8Nme
VtQFYmWG2r8Wl5RsUhfTlU3qNxkWOoAGhLWxMR1RAn77o8TgPZAG1Bl+0YhmeSeP
hVv64EAYyfBfoYCINn/STLFdQ74RWnZJ/7uzJysXYHWgBbjoPxZht4uW3R59miGa
2GqMoMYni2CC4KDFOVQsrh6un1g9E4gAaO9qjdSvQIbjj+rogsKVVxlN4uczD/3w
O4Zo+FcwUDehd8jki05FstSML795hp04AOr9e2jIRAf3UBQoQtvuVeGLRRpDGTGQ
InVwPBsws0Y4ukMbg76unToHtFNIHd0+9Nlqnn6QxYlaRbwGBkcqhW0c40al3vKr
x4/Er0QWbj1MO37isvSTblKJJwY2Od4R2odkiJ1hC5EdPFiv73vHCmWuhVhvU+t5
6Wj5LnA19wXg6uu69Q9/uETxUwaSS/T6DkoyCr4B3xQx90gE4kN11OYVFKCG0l0p
Kk22WPwdYlLzfJuVg0t8QQARAQABwsOEBBgBCgAPBQJpO+mHBQkPCZwAAhsuAikJ
ECjJFf46smcVwV0gBBkBCgAGBQJpO+mHAAoJEJ7K+puhl2KElfMQAIlOdIODc5vY
afKNKyDqaJsIHpjfkBcGvbFnuhYQ2Yp6cT8JSFgE4LAGmIAOAdlo25xboT4Y9Swh
C2hBpPocJKto8fMhF7ShDEN4iYHeubfiAzfa13r6b+MIR6znIjcRzb0KKzFGtagJ
y4Tp9LUIaxvAeEnOQ73SYVkF3nvdp7ku400V8MG3DJGNO1ByDNXGuojLGyhyUNks
aOsWq1eAggzvi3haSdLKrS6UK5bVMdAjGI7hsc5gSEISPyxZFgyLtYtWuqhiDE0g
oaNKibLRM+cjgwE/o1sNAbUeguqdmTcbQ1NMzDVzfuM30DiAI+gtGlZVpKmQPTKF
uVU3eCc+Fd7AWbXAk72as0DWZ6XUGIoSzo9VXMTcyYu1Cz50T9ck+HwWeEuD0km3
j6c0JQgvgUzOf+syQTzAKEeWa4xGhw5F1eHdoLf70in6kQKCCtjoGipRlyM7kTJh
XlCErlByxCTRYR20hR7ZkYS7kO2+T62isS3D5CtPRNrO9Wo4zfoSfuTw/98Md8JZ
6dsHS4egH3vi+sM6JBW+ClbmQPdPi0ENBVjJdReWoVWphCBlV74CJ7zDRxBy1teE
m+qCh01LuY57LugOPzVhxaOBycEQ1iRdlH3/3E3RMhec+NDOcN49dz656Wj1i04R
9W8BL6VA5mznW5yWYyLr7jgnbQKuWsxqymIP/35Wd/m4FxkOG+G5SD5/0b4erZPq
5sNTohf0UEPPddkSqXNs555agJ07Jhv0FwXgacMwWSw3Zx+tcBde0FS4uMmCkBua
ayonlqt9dYyqn7hEOsKdtuCX4OW4XbOXT5c/Eh9sbS52mRlXmYSSV4YovEke5gZ6
lcPrieCOOdWVeLgScGHpUNCDJ+FFo+/GRe6ouvUqaA0hzfiw7bzoM6x7CGcl/S6u
BpeDQgkBoEFlrHnjhWpel1StVWdP7ZQndk7KCipmXtb0ntuKAL9DYOX+I6FRkaNo
sueBQ64eny3VYfnrJOhkuDTK8JQdagM1M02oRdv8daGXls34A5WC73y4vszGsf6P
DLZQmLGJLDyXqoFoS4boMbN0jUYbvtiKKllwktPTjnG5vacQotXFYyJIBUieDDEI
GT1GCi5gbCKIdyuL9lSAp9MAMu7wPfI3jQ8bZvm6VaDdqHZTB0eH9jJAzbRxbIbL
+JmIsB3WZT4hU6Ok5TU88z4YHaQUewNWZnfPaAwNrGDLgVrqA12ogmJI7qMhX/yV
cV4PSbIWUSk6yFtTrL3H9QOI7hNl5RgJkPJA/zZDtGwV4T6m07+Sq72Ifd7IMRo2
zdZprS/qJRWJyKKnIdnScjaOOQRme/syGZp3bFcMhTrIcfE7vb1/VcXRpqMqU2ac
FXq62bQgpmqIBsQl
=1OHf
-----END PGP PUBLIC KEY BLOCK-----