VitalIT — IT infrastruktura in podpora

Responsible Vulnerability Disclosure Policy

In the company VITALIT d.o.o. we take the security of our websites, services and information systems seriously. This policy describes how security researchers and others can responsibly report a potential security vulnerability to us.

The policy does not constitute a public bounty program for discovered vulnerabilities and does not permit unlimited security testing.

1. The purpose of the policy

The purpose of this policy is to provide a clear and safe way to report potential security vulnerabilities discovered on publicly accessible systems directly managed by VITALIT d.o.o.

Our goal is to understand, verify, and handle the report appropriately, while protecting users, customers, data, and system performance.

2. How to report a vulnerability

Send the application to: info@vitalit.si

For the message title, use:Report a vulnerability

You can prepare the application in Slovenian or English.

Do not include passwords, access tokens, private keys, entire databases, or other sensitive information that is not necessary to understand the problem in the message.

3. What information should the application contain

When possible, include:

  • URL, domain, application or system where you experienced the problem;
  • a clear description of the suspected vulnerability;
  • steps to replicate the finding;
  • possible impact of the vulnerability;
  • date and time of detection;
  • the device, browser or software environment used;
  • limited screenshots, logs or other evidence necessary for verification;
  • your contact information to receive a response.

Evidence should contain only the minimum amount of information necessary to demonstrate the problem.

4. Permitted Activities

When checking for a potential vulnerability:

  • use only non-invasive and non-destructive methods;
  • limit verification to the minimum extent necessary to demonstrate the problem;
  • use your user accounts and data whenever possible;
  • not affect the availability or normal operation of the system;
  • cease immediately when the existence of a vulnerability is properly confirmed;
  • report the vulnerability without undue delay.

The presence of this policy does not constitute blanket permission to conduct penetration testing or other security reviews.

5. Prohibited Activities

Without prior written permission, the following are not permitted:

  • denial of service attacks or stress testing;
  • mass or automated scanning that could affect the operation of systems;
  • password guessing, brute-force attacks or credential stuffing;
  • social engineering, phishing or impersonation;
  • physical security testing;
  • installing malicious software;
  • establishing permanent access or persistence;
  • altering, deleting or corrupting data;
  • accessing the accounts or data of other users;
  • download entire documents, mailboxes, databases or archives;
  • obtaining source code or configurations that are not publicly available;
  • public announcement of vulnerabilities before coordination with VITALIT d.o.o.;
  • testing the systems of our customers or other third parties.

Customer systems are not included in this policy, even when VITALIT d.o.o. participates in their maintenance.

6. Data protection and privacy

If you accidentally come across personal, confidential, business or customer information during verification:

  1. immediately cease further access;
  2. do not download, copy, modify or share the data;
  3. do not create additional recordings unless necessary to demonstrate the problem;
  4. provide only the minimum amount of information in the application;
  5. notify us that sensitive data may have been exposed.

Do not send sensitive data by regular e-mail, unless it is necessary and you have previously agreed with us on the appropriate method of transmission.

7. Application processing procedure

After receiving the application, we will endeavor to:

  • acknowledge receipt of the application;
  • verify that the application contains sufficient information;
  • technically evaluate the findings;
  • prioritize based on potential impact;
  • take the necessary measures or forward the report to the competent owner of the system;
  • request additional information from the applicant as necessary.

The processing time depends on the complexity, impact, availability of the fix and the possible involvement of third party providers.

VITALIT d.o.o. it does not guarantee a fixed time for elimination and does not guarantee a monetary or other reward.

8. Coordinated Disclosure

Please do not make information about a vulnerability public until: We

  • do not check for vulnerabilities;
  • we do not assess the impact;
  • we fail to take reasonable measures to mitigate the risk;
  • we do not agree with you on the appropriate timing and extent of disclosure.

Public disclosure without prior coordination may increase risk to users, customers, and other organizations.

9. Scope of Policy

The policy applies to publicly accessible websites and systems directly managed by VITALIT d.o.o., unless otherwise stated on the individual system.

The policy does not automatically apply to:

  • our customers' systems;
  • business partner systems;
  • services of other providers;
  • third party platforms or infrastructure;
  • user accounts not owned by the applicant.

If you are unsure whether a system is within the scope of this policy, please write to info@vitalit.si.

10. Contact

Report security vulnerabilities to: info@vitalit.si

Message subject:Report a vulnerability

For general questions, incidents, user issues, or support requests, please use VitaliT's normal contact and support channels.