Security

Reporting a vulnerability in FISRO#

If you believe you have found a security vulnerability in fisro.org, please tell us through the contact form with the subject “General enquiry” and the word “Security” at the start of your message. Describe the issue and how to reproduce it, but do not include sensitive data you may have accessed.

We ask that you:

• give us reasonable time to fix the issue before disclosing it publicly;
• do not access, change or delete data that is not yours, and stop as soon as you have shown the issue exists;
• do not run denial-of-service tests, social-engineering attacks or physical tests.

We will not pursue legal action against good-faith research that follows these guidelines. We do not currently offer financial rewards.

How we protect information#

• The public website and the editorial system run as separate processes under separate accounts, with separate database permissions. The public website can read only published content.
• Threat reports are encrypted with a public key on arrival. The key needed to read them is held only by the restricted review system.
• All editorial accounts require multi-factor authentication. Actions are recorded in an audit log.
• The site uses HTTPS everywhere, a strict Content Security Policy and no third-party scripts.
• Databases are backed up nightly.