Coordinated Vulnerability Disclosure
Last updated: August 2026
This policy explains how to report a security vulnerability in DigitalFreedom products and how we handle it.
Report a vulnerability
Found a security issue in one of our products? Please tell us. Use either channel:
Email: security@digitalfreedom.co.za
Reporting portal: security.digitalfreedom.co.za
To help us triage and fix quickly, please include where possible: the affected product, service or URL and its version; a description of the vulnerability and its impact; steps to reproduce (including any proof of concept); your assessment of severity; and how you would like to be credited, if at all. Please share no more personal or third-party data than is strictly necessary to demonstrate the issue.
Scope
This policy covers the DigitalFreedom-branded mobile and desktop applications, the backend services and APIs that support them, and our public websites and portals. Third-party platforms, app stores, hosting providers and dependencies we do not operate are out of scope; please report those to the respective operator. We will coordinate with such parties where an issue affects our products.
What we commit to
- Acknowledge your report without undue delay (target: within 3 business days).
- Assess and validate the vulnerability and determine its severity.
- Keep you informed of meaningful progress and tell you when a fix or mitigation is available.
- Remediate confirmed vulnerabilities within a reasonable, risk-based timeframe, prioritising severity and exploitability.
- Favour coordinated public disclosure once a fix is available and users have had a reasonable opportunity to update, agreeing timing with you where practical.
- Where the law requires it, notify the competent authority of an actively exploited vulnerability or a severe incident within the statutory deadlines.
Safe harbour
We will not initiate or support legal action against you for security research and vulnerability reporting carried out in good faith and in line with this policy. We consider such activity authorised access and will not treat it as a violation of our terms of service, of anti-circumvention rules, or of computer-misuse / unauthorised-access laws (including the U.S. CFAA and equivalents elsewhere). If a third party brings action against you for activity conducted in compliance with this policy, we will take reasonable steps to make known that your actions were authorised. This safe harbour applies only while you follow the rules below.
Rules of engagement
- Make a good-faith effort to avoid privacy violations, data destruction, and interruption to others.
- Access and retain only the minimum data needed to demonstrate a vulnerability; never exfiltrate, store or share other users' personal data.
- No denial-of-service testing, spam, social engineering of staff or customers, physical attacks, or attacks against our suppliers.
- Do not disclose the vulnerability publicly, or to third parties, before we have remediated it and coordinated disclosure with you.
- If you encounter personal, financial or otherwise sensitive data, stop and notify us immediately.
- Test only against accounts you own or have explicit permission to use, and comply with all applicable laws.
Confidentiality
We treat vulnerability reports as confidential. Personal data in a report is processed solely to handle the report and remediate the vulnerability, on the basis of our legitimate interest in product security (Art. 6 (1)(f) GDPR) and to comply with legal obligations (Art. 6 (1)(c) GDPR), and is retained only as long as necessary. Our Privacy Policy applies.
Recognition
We do not run a paid bug-bounty programme at this time. With your consent we are glad to credit reporters who responsibly disclose valid vulnerabilities, in a public acknowledgements list or in the release notes for the fix. You may also choose to remain anonymous.
Changes
We may update this policy at any time; the version published here at the time of your visit applies. This page is referenced from our security.txt (RFC 9116).