Coordinated Disclosure Programme
This document formalises what the Security page set out in principle: the exact scope of our programme, the rules of engagement, our handling times, and the history of reports received.
This English translation is provided for convenience only. In the event of any discrepancy, the French version prevails.
What is covered.
The programme covers all public digital assets of AXIS FINANCE and KANU.
- Corporate websiteaxis-finance.net and all of its pages, in French and English.
- Associated infrastructureDNS records, TLS certificates, security headers, publicly observable server configuration.
- Form submission endpointServer-side processing of the contact and sign-up forms.
- KANU applicationOnce released on app download platforms — the scope will be specified at launch.
Out of scope. Denial-of-service attacks, social engineering targeting our staff, physical intrusion attempts, and any testing against third-party services that we use (hosting provider, registrar) but do not directly control.
What we ask of you, what we guarantee.
Act with restraint
- Give us a reasonable period to fix the issue before any publication
- Stop at the first sign of access to real data
- Never degrade service availability (no large-scale automated load)
- Never access, modify or delete a third party's data
- Provide a reproducible report: steps, estimated impact, proof of concept where relevant
Act in good faith
- Acknowledge receipt within five business days
- Assess the severity and inform you of it
- Keep you informed of progress until the fix
- Never take legal action against a researcher acting in good faith within this framework
- Credit your finding in the history below, if you so wish
A commitment, not a vague promise.
The target fix time depends on severity, assessed using the CVSS 3.1 framework.
| Severity | Example | Acknowledgement | Target fix |
|---|---|---|---|
| Critical | Remote code execution, access to third-party data | 24 hours | 7 days |
| High | Authentication bypass, injection | 72 hours | 30 days |
| Medium | Configuration flaw, missing header | 5 business days | 90 days |
| Low | Defect not affecting data security | 5 business days | Best effort |
These times are internal targets, not contractual guarantees. A complex fix may require more time; in that case we will inform the researcher who submitted the report.
Reports handled.
Published to show that this programme actually works, not merely that it exists on paper.
| Date | Severity | Summary | Status |
|---|---|---|---|
| No reports received to date since the programme opened. | |||
This page will be updated after each report is handled, with the agreement of the researcher concerned on the level of detail published.
Write to us before writing anywhere else.
security@axis-finance.net — acknowledgement within five business days.
