Responsible Disclosure

3. Scope

In scope are the public systems operated by Nocera Information Security ME®:

• the nocerainfosec.com.br website and its subdomains;
• the contact form and the tools published on the site, such as the Pentest Scope Builder.

Client, partner and third-party systems (including the hosting, email and anti-bot providers we use) are out of scope. Vulnerabilities in those systems must be reported directly to the parties responsible for them.

4. What interests us

Vulnerabilities with real impact on the confidentiality, integrity or availability of in-scope systems, for example:

• remote code execution and injection (SQL, commands, templates);
• stored or reflected cross-site scripting (XSS) that works without unusual victim interaction;
• server-side request forgery (SSRF), file reading and directory traversal;
• authentication or access control flaws;
• exposure of personal data, credentials or secrets;
• bypassing the anti-bot check or abusing the contact form to send messages on behalf of third parties;
• bypasses of the content security policy (CSP) that allow executing code on the site.

5. What we do not consider a vulnerability

So that we can focus on what matters, the items below are not accepted as reports, unless you demonstrate a concrete impact:

• automated scanner results without manual validation;
• missing headers or configurations considered best practices, without a demonstrable attack;
• clickjacking on pages without sensitive actions;
• email SPF, DKIM or DMARC configurations;
• software versions, banners and error messages without sensitive data;
• self-XSS and attacks that require physical access to or control of the victim's own browser;
• missing rate limits on pages without sensitive actions;
• TLS suites and configurations without a practical attack;
• broken links, content issues, spelling or browser compatibility.

6. What must not be tested

• denial of service (DoS or DDoS) and tests that degrade system availability;
• social engineering against people at Nocera, at clients or at partners (phishing, vishing, smishing);
• physical access to facilities or equipment;
• automated mass submission through the contact form or spam;
• accessing, altering, copying or deleting data that is not yours, beyond the minimum necessary to demonstrate the problem.

7. What we expect from you

• act in good faith and stop the test as soon as you confirm the vulnerability;
• not disclose the vulnerability publicly before it is fixed, or before we agree on a date;
• not exploit the flaw beyond what is necessary, nor maintain access to the systems;
• securely delete any data obtained during the test.

8. What you can expect from Nocera

• confirmation of receipt of the report;
• technical analysis and communication about progress until the fix;
• jointly agreeing on the public disclosure date, if you want to publish the research;
• confidential treatment of your data and of the report's content.

We do not offer financial rewards (bug bounty). If you want, we will publicly acknowledge your contribution after the fix, with the name or handle you provide.

9. Protection for those acting in good faith

We will not take legal action against anyone who researches and reports vulnerabilities in accordance with this policy. If a third party person or company takes action against you for an activity carried out in compliance with this policy, we will make it clear that it was authorized by us.

Nocera Information Security ME®, CNPJ 24.305.640/0001-78. This policy complements the Terms of Service and the Privacy Policy. Contact file for researchers: security.txt.