Responsible Disclosure Policy

At Ravelin, we take the security of our customers' data very seriously and we are always aiming at further securing our platforms and the data it holds. As such, we are inviting security researchers to disclose any findings they may have pertaining to our systems, and we will action them appropriately.

Scope

For the purpose of testing, the following services are considered in scope:

www.ravelin.com
*.ravelin.click
*.ravelin.com
*.ravelin.net

Any service that falls outside of the above list should be considered out of scope and therefore should not be tested.

Out of Scope

As mentioned in the Scope section, any host not specifically mentioned is considered out-of-scope. Alongside this, the following vulnerabilities are specifically out of scope and should not be tested due to potential service impact or being considered low risk.

Security Practices where other mitigating controls exist i.e. missing security headers, etc.
Sender Policy Framework (SPF), DKIM and DMARC configuration suggestions
Social Engineering e.g. Phishing
Physical Attacks
Missing Cookie Flags
CSRF with minimal impact i.e. Login CSRF, Logout CSRF, etc.
Content Spoofing
Stack Traces, Path Disclosure, Directory Listings
SSL/TLS controls where other mitigating controls exist
Banner Grabbing
CSV Injection
Reflected File Download
Reports on out dated browsers
DOS/DDOS
Host header Injection without a demonstrable impact
Scanner outputs without any proof-of-concept attack
Vulnerabilities on Third-Party Products
User Enumeration
Password Complexity
HTTP Trace Method
Tokens/Keys that are intended to be public

Reporting

To ensure that any vulnerability disclosures are made responsibly, please make sure to follow the following requirements:

All submissions should be made by emailing vulnerability.disclosure@ravelin.com using the PGP key below to encrypt the content. Any other form of reporting will not receive a response and repeated attempts to use other emails may result in the email being flagged and the address blocked.
Your report should include a detailed summary of the vulnerability, including the target, steps, tools and artefacts used during the discovery that will allow us to reproduce the vulnerability.

PGP Key

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBGEyFHEBEADAfMJJOx0GqEiFtbPZJKfYFbAa7noXAM08RuaGt0IaaB9v/cLf
xziHo06ZThZrOgmoXfYtQF9TdGrp5sVownqi835jTlsxmUqVrJNH8vx/klA7gN3c
Z6+CrVAZArITesdf2F0vNClduGWP3WivOFBVck5yKZIYBrqr4rWZwGGfYrKP6Tn1
geJ25D+xrVcvxKSW+TtOBoryZC1VxChRE0N85E/+KU0wJod1OEEfV5RSJ53noWXy
5pIVIZuNKJZVc5BbdsMpzw7Hk0ERQq8dFr+5kHx3ey3bjgAiInKGAiHp169F+1MF
LkaX/VZZKQ7Gs7yfRQFRQRKijYnuDaRaPBsMqVxiWVoLDrT+rbxlXrnOcZwP9NVQ
bn+g6HEmkvtHtCmTKGQrjzlGu93SuvHbst+bRiY0CrK1wJItpd7rJohtdKgsGspt
kBtGxHB6H+w8uRdb8aIbqE0DFhoO/9RmyS37iNpRv/FahthGlL6t4cWm3P3akZu6
G+FCLUU9pnrH51QXR6YOGyU35Q8UU0jFgsfRRDDGTgx6nERQXDaGWmDUdlaYejvP
Fj80uWA5zPpIh8ER83zKotC5u5rlkSPD78XtbPRIb8G9kA/ylinn+5iMayL2IfYO
D3iEO9t5rC1BcaW2qPTalwYLIG/bbb+OV4T0Yi4oopUQZPvbHMOA6kSHJQARAQAB
tCtWdWxuIERpc2Nsb3N1cmUgPHZ1bG5lcmFiaWxpdHlAcmF2ZWxpbi5jb20+iQJO
BBMBCAA4FiEEOFw/Aua8UFUZBZAaKkfpcED+TxMFAmEyFHECGwMFCwkIBwIGFQoJ
CAsCBBYCAwECHgECF4AACgkQKkfpcED+TxNouxAAi9jg5tPuENAJ08kaCJI/tj6w
kXO7sSqkx3EzpCf+ie644zkUjTQrHrhNXISBlT9j4Ex/96s87pUcLUgzOGnNM2Ux
LEVSGooFAG7d4ws4R35qEXum2eZgOnXy2e/kVz/qLwKaQyvOer8UTX0FOIrgxkjE
l4ulSqADFU4U5a/d5/wKt0DZNyFepnVKcjHllYrlJTAYIdmElbrBeM36aIowaDF5
6WR+Gb4KEVsC19rnO+5PF0K6U3jmfjw8q78f8JjrCnjlk32blLNNcKY4pG5PwLiE
wD7vPodh1LJL8P6GDe0ELS8UIFTpxBdjyJXol0tpADM+Mc0bURiF7z/ZIXehfhQj
Gf1TmuxKbjpQweqOLCcJrggovrB7lZ2RWYWpE7YYV48/FuF1T/pOWlin6t+vWbkT
xZ7Y5Rj2Vv7QQA2qG7HVoKS8X2p5zGoljrzrvWNrLPiJKqfgdHkCHOaManheCYMn
Y75AYRl0iMkm8YFUJeRkObfj6fdQURUwQeYrV9HsKhI0GTc6v08YFcuO2XYRFhxL
xB8qawFnUHLA8CoPny4H7DAa2PvrjALjdbwzkMXDLuz/p+bRj08+w0KD9HX2rRyy
Gk1S7czY6U3UDVl4hfnR0pAn8nvozFsJLOlsjpPmd2u7C1C5ZvqXhQEedUuNLH3u
Jf5PjUSqe3sl9RpFXZq5Ag0EYTIUcQEQAK3W/7jhUtA+006HzJFDEJIDeMRTn6jI
eVotrEPBkaCTvhBCkFpFzbuxnhF513EtY0JUa+s3/dBMPIvolcGVWVXnKh/sTa8+
8O2cxTUkRuZzjHFcKTNQP4q1Fytnd8x3r0Nt0z/6O/3ynjs8nTcT/SJKfnCNkzEV
qCJULqq31ctrTnDzFnY7V94XhdqGcZgTHUa1k/z6xFXLGngx+NTe6wWRmEd20Xsb
iOO3TiehrywxFkngiR0SO75KVlfQc/ixWnzkz8qmJF8Wam/hHQ+PO/xQMaH0Qsya
L8u+g4h1iD+sINUnESMNobzyBKmGr2bjfEXbSAOcMro6Vg699t0YIjxMbqO8/qE7
zSL9D0IsJS8Ru7oJ0rljZ0EkPvAsAds3Orf7JkpkkkDCnVBpHMoBuFR9Ie74H6SA
F1q+iDP6QnfusXJJESH5H2x3UeC4LTZR6QW5AAPG8vdSalo2VWLRh+mdm31uo4cX
iziSQ+GtdqAOsiCtPV3oJDbGmtf1qseGdNdwyN2Ehg94IsL3hhSnBIv0VnZaEi6b
ZavCDB9yvIFg2/gEf/uhjAu9KwFd5Bf+gPGlTwMYzM9121ENawF8eVY840Vv8O06
RkPK4rXNS2TKZGlzkzPNod4tjZnDzfeE2elaQ+aFcAH6aYwyPm7xK7rJP/LubN7v
1jCa1hJVRfMtABEBAAGJAjYEGAEIACAWIQQ4XD8C5rxQVRkFkBoqR+lwQP5PEwUC
YTIUcQIbDAAKCRAqR+lwQP5PE0ZQD/9JPUHUkTe4X+L1AC0VaDCFADvoY14APyuK
gFPSDlzamgkWAA4tsFPA5OO9+h2UKzpJbYRYBhWg0t3xfquARpQ5rwE3VPC9FMKS
tZNCf+8OreI9wXC5XOd3pESc9eUGGB1ow+Lr+TPIH3RHBNXizhjpAWDLYFaqq9ed
pkb+UNShWLvBrquP0nS8S2cjmSEFN5reT64iNOU+QSnA9nOtDAodfDIyhc+iyl/D
1R7vcZZCd72QQpO9jUuRIimjs1EB6oV+BCxEhy5Z+E/gCknrm7Mxg99ask/7q+60
7qEhL/EzXRn+czUdVL+3XamxekcaiPIQxqVAN6mGHIXLyX/GsMvgXpPbLW+ChldR
XAWzzDg9Y7hn31B5DgYclkRTFCTF5BWczSXcBm1v7JUrQlH4Ej8S8FXI1X2hy4dh
RF+2gD8UDxFCCL3/n5FPpCDMWfBxaT1qAM9dezdi1IqjSA1ZSy+KpZ2/0TkfxMIo
v1N8WpE3Py4ASDRPG7RR1CEfKVe+kTspsJ7ZZxzSYPnMZJfeuA4yRiAAfhAAaESK
y8e6YvrsaGMiwjXYyGS08AUyDpaJEKKmPoEGo/z0df+y3pNeZvM0fHzIkDbADtGH
bEPtboQpX364U8RyH3z6ZesIlUckLwetDjLDV2w1+LsvAHE6cjmaY4jEK3NweswL
hPK3J1Ycjw==
=GdqN
-----END PGP PUBLIC KEY BLOCK-----