CINXE.COM
Responsible Disclosure
<!doctype html> <html lang="en"> <head> <meta name="viewport" content="width=device-width, initial-scale=1.0, shrink-to-fit=no"> <link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/css/bootstrap.min.css" integrity="sha384-Vkoo8x4CGsO3+Hhxv8T/Q5PaXtkKtu6ug5TOeNV6gBiFeWPGFN9MuhOf23Q9Ifjh" crossorigin="anonymous"> <link rel="stylesheet" href="/walsheim.css"/> <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700&display=swap" rel="stylesheet"> <link rel="stylesheet" href="/main.css"> <link rel="icon" type="image/png" href="/img/favicon.png"> <script async defer data-domain="wave.com" src="https://plausible.io/js/plausible.js"></script> <title>Responsible Disclosure</title> </head> <body> <header> <nav class="navbar navbar-expand-lg navbar-light"> <a class="navbar-brand" href="/en/"><img src="/img/nav-logo.png" class="logo-small" alt="Wave logo"></a> <button class="navbar-toggler" type="button" data-toggle="collapse" data-target="#navbarCollapsible" aria-controls="navbarSupportedContent" aria-expanded="false" aria-label="Toggle navigation"> <span class="navbar-toggler-icon"></span> </button> <div class="collapse navbar-collapse" id="navbarCollapsible"> <ul class="navbar-nav mr-auto"> <li><a href="/en/">Personal </a></li> <li><a href="/en/business/">Business </a></li> </ul> <ul class="navbar-nav ml-auto"> <li><a href="/en/about/">About</a></li> <li><a href="/en/careers/">Careers</a></li> <li><a href="/en/blog/">Blog</a></li> </ul> </div> </nav> </header> <main id="articleWrapper" class="waverow"> <article> <h1>Responsible Disclosure</h1> <br/> <p><em>Wave Mobile Money</em> is committed to ensuring the security of our products and services. This policy is intended to give security researchers clear guidelines for conducting vulnerability discovery activities and to convey our preferences in how to submit discovered vulnerabilities to us.</p> <p>This policy describes what systems and types of research are covered under this policy, how to send us vulnerability reports, and how long we ask security researchers to wait before publicly disclosing vulnerabilities.</p> <h3 id="authorization--safe-harbor">Authorization & Safe Harbor</h3> <p>If you make a good faith effort to comply with this statement during your security research, we will consider your research to be authorized, and Wave agrees not to pursue or support any legal action related to your research.</p> <h3 id="guidelines">Guidelines</h3> <p>Under this policy, “research” means security activities in which you:</p> <ul> <li>Notify us as soon as possible after you discover a real or potential security issue.</li> <li>Only use exploits to the extent necessary to confirm a vulnerability’s presence.</li> <li>Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.</li> <li>Once you’ve established that a vulnerability exists or have identified exposed sensitive data you must stop your test, notify us immediately, and not disclose this data to anyone else.</li> </ul> <h3 id="restrictions">Restrictions</h3> <p>The following test methods are not authorized:</p> <ul> <li>Denial of service (DoS or DDoS) tests or other tests that impair access to or damage a system or data</li> <li>Physical testing (e.g. office access, open doors, tailgating), social engineering (e.g. phishing, vishing), or any other non-technical vulnerability testing</li> <li>Social engineering (including phishing) to our staff or contractors</li> </ul> <h3 id="scope">Scope</h3> <p>This policy applies to the following systems and services:</p> <ul> <li>Wave primary website (<a href="https://www.wave.com">https://www.wave.com</a>)</li> <li>Web Applications</li> <li>Mobile & Merchant Applications</li> </ul> <p>Any service not expressly listed above, such as any connected services, are excluded from scope and are not authorized for testing. Additionally, vulnerabilities found in systems from our vendors fall outside of this policy’s scope and should be reported directly to the vendor according to their disclosure policy (if any). If you aren’t sure whether a system is in scope or not, contact us at <a href="mailto:security@wave.com">security@wave.com</a>.</p> <h3 id="reporting-a-vulnerability">Reporting a vulnerability</h3> <p>We accept vulnerability reports via <a href="mailto:security@wave.com">security@wave.com</a>. Reports may be submitted anonymously. If you share contact information, we will acknowledge receipt of your report within 3 business days.</p> <p>If your report contains sensitive data, please use the public GPG key provided below to encrypt and email your findings to us.</p> <p><em>Encryption: <a href="/security/wave.pgp.txt">https://www.wave.com/security/wave.pgp.txt</a></em> <br> <em>Signature: <a href="/security/wave_security.txt.sig.txt">https://www.wave.com/security/wave_security.txt.sig.txt</a></em></p> <h3 id="what-we-would-like-to-see-from-you">What we would like to see from you</h3> <ul> <li>Describe the location the vulnerability was discovered and the potential impact of exploitation.</li> <li>Offer a detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful).</li> </ul> <h3 id="what-you-can-expect-from-us">What you can expect from us</h3> <ul> <li>Within 3 business days, we will acknowledge that your report has been received.</li> <li>To the best of our ability, we will confirm the existence of the vulnerability to you and be as transparent as possible about what steps we are taking during the remediation process, including any issues or challenges that may delay resolution.</li> </ul> </article> </main> <footer> <div class="main-footer"> <section class="logo-lang"> <a class="logo" href="/en/"><img src="/img/nav-logo.png" class="logo-small" alt="Wave logo"></a> <div class="lang-menu btn-group dropup"> <button type="button" class="btn dropdown-toggle" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false"> <h5>English</h5> </button> <div class="dropdown-menu"> <a class="dropdown-item" href="/en/security/responsible_disclosure/">English</a> </div> </div> <p class="copyright"> © Wave Mobile Money Inc. </p> </section> <section class="wavecol" id="footer-navigation"> <h5>Company</h5> <ul> <li><a href="/en/about/">About Us</a></li> <li><a href="/en/careers/">Careers</a></li> <li><a href="/en/blog/">Blog</a></li> </ul> </section> <section class="wavecol" id="footer-navigation"> <h5>Legal</h5> <ul> <li><a href="/en/terms_and_conditions/">Terms and Conditions</a></li> <li><a href="/en/security/responsible_disclosure">Responsible Disclosure</a></li> <li><a href="/en/wdf/">Wave Digital Finance</a></li> <li><a href="/en/privacy/">Privacy Notice</a></li> </ul> </section> <section class="wavecol"> </section> <section class="download-links"> <a href="https://play.google.com/store/apps/details?id=com.wave.personal"><img class="download-badge" src="/img/en/google-play-badge.png" alt="Get it on Google Play"></a> <a href="https://itunes.apple.com/sn/app/wave-mobile-money/id1523884528"><img class="download-badge" src="/img/en/app-store-badge.svg" alt="Download on the App Store"></a> </section> </div> </footer> <script src="https://code.jquery.com/jquery-3.4.1.slim.min.js" integrity="sha384-J6qa4849blE2+poT4WnyKhv5vZF5SrPo0iEjwBvKU7imGFAV0wwj1yYfoRSJoZ+n" crossorigin="anonymous"></script> <script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js" integrity="sha384-Q6E9RHvbIyZFJoft+2mJbHaEWldlvI9IOYy5n3zV9zzTtmI3UksdQRVvoxMfooAo" crossorigin="anonymous"></script> <script src="https://stackpath.bootstrapcdn.com/bootstrap/4.4.1/js/bootstrap.min.js" integrity="sha384-wfSDF2E50Y2D1uUdj0O3uMBJnjuUD4Ih7YwaYd1iqfktj0Uod8GCExl3Og8ifwB6" crossorigin="anonymous"></script> </body> </html>