Reporting a vulnerability
For responsible disclosure of security issues in Jumoo products or services, here is what we ask, and what you can expect from us.
Reporting a vulnerability
- Email security@jumoo.co.uk
- Give us as much information as you possibly can
What we will do
We will acknowledge any security report as soon as possible, usually within one or two business days. We will confirm whether we can reproduce the issue, and we may come back to you for more information.
If we can reproduce it, we will give you a clear timeline and process for how we intend to fix it.
When we are ready to release a fix, we will work with you to make sure you receive credit for your help.
Once the fix is out, we will publish an update and a blog post explaining the issue - sometimes holding back detail until people have had time to patch.
What we would like from you
We ask that you report issues directly to us, and that you:
- Do not disclose the issue to anyone else, or file a CVE, while we work on it
- Provide a proof of concept showing how the issue could be exploited
Please note that the results of an automated security scan do not on their own show that an issue is viable. We need to establish whether and how something is exploitable before we can act on it.