🛡️ 6estates.com Security Policy

1. Introduction

This document outlines the security policy for 6estates.com and its associated services. We take security seriously and appreciate your efforts to help us maintain a secure platform. This policy provides guidelines for reporting security vulnerabilities and defines our expectations regarding responsible disclosure.

2. Scope

This policy applies to all 6estates.com domains, subdomains, and related services, including but not limited to:

• All websites under the 6estates.com domain
• Mobile applications developed by 6estates
• APIs and web services operated by 6estates
• Email services and infrastructure
• Cloud infrastructure and hosting services

3. Reporting Security Issues

If you discover a security vulnerability in our systems, please report it through one of the following channels:

When reporting a vulnerability, please include the following information:

• A detailed description of the vulnerability
• Steps to reproduce the issue
• Any relevant screenshots or logs (without compromising sensitive data)
• Your contact information if you wish to receive updates

4. Safe Harbor Policy

We commit to not initiating legal action against security researchers who:

• Report vulnerabilities in good faith
• Do not exploit vulnerabilities beyond what is necessary for demonstration
• Do not disclose vulnerabilities to third parties before we have had reasonable time to address them
• Make a good faith effort to avoid privacy violations and service disruptions
• Follow responsible disclosure timelines and communicate professionally

5. Vulnerability Disclosure Process

1. Report: Submit vulnerability details to security@6estates.com
2. Acknowledgment: We will acknowledge your report within 48 hours
3. Assessment: Our security team will assess the vulnerability and determine its validity and severity
4. Prioritization: Valid vulnerabilities will be prioritized based on severity and potential impact
5. Resolution: We will work to resolve the issue within an appropriate timeframe depending on severity
6. Verification: Once fixed, we will verify the solution addresses the issue
7. Disclosure: We may publicly acknowledge your contribution (with your permission)

6. Timeline Expectations

7. Prohibited Activities

The following activities are strictly prohibited and may result in exclusion from our security research program:

• Social engineering, phishing, or physical security attacks
• Automated scanning or brute force attacks that cause service disruption
• Accessing or modifying data beyond what is necessary for vulnerability demonstration
• Denial of service attacks or attempts to overwhelm our systems
• Exploiting vulnerabilities for personal gain or unauthorized access
• Disclosing vulnerabilities publicly before the agreed-upon timeline
• Violating privacy of other users or employees

8. In-Scope Vulnerabilities

We are particularly interested in reports of the following types of vulnerabilities:

• Cross-site scripting (XSS) - especially when they affect authenticated users
• Cross-site request forgery (CSRF) - especially when they can perform sensitive actions
• SQL injection and other injection flaws
• Authentication and authorization bypasses
• Server-side request forgery (SSRF)
• Broken authentication mechanisms
• Security misconfigurations leading to unauthorized access
• Business logic flaws that allow unintended operations
• Information disclosure through improper error messages or API responses
• Weak cryptography or inadequate password storage mechanisms

9. Out-of-Scope Vulnerabilities

The following are generally not eligible for recognition (though we appreciate awareness of these issues):

• Clickjacking on pages without sensitive actions
• Self-XSS that cannot be used to exploit other users
• Missing security headers without demonstrated impact
• Vulnerabilities in third-party libraries without proof of exploitability
• Theoretical vulnerabilities without practical exploit scenarios
• Issues requiring unlikely user interaction or social engineering
• Spam and abuse of user-generated content systems
• Network-level DDoS attacks

10. Recognition and Rewards

While we do not operate a formal bug bounty program with guaranteed payments, we are committed to recognizing valuable security contributions:

• Public recognition in our Security Hall of Fame
• Exclusive 6estates.com security swag
• LinkedIn recommendations for significant contributions
• Priority response and handling for future reports
• Invitations to exclusive security events

Recognition is at our discretion and depends on the severity and quality of the report.

11. Additional Security Measures

We continuously invest in security measures to protect our systems and users:

• Regular penetration testing by certified third parties
• Automated security scanning of our codebase and infrastructure
• Employee security training and awareness programs
• Implementation of security best practices in our development lifecycle
• Monitoring and incident response capabilities

12. Contact Information

For security-related questions or reports:

• Primary Contact: security@6estates.com
• Encrypted Communication: Use our PGP key for sensitive information
• Security Team: 6estates Security Team