Vulnerability Disclosure Policy

Delivering secure services and ensuring the privacy of our customers and partners is the highest priority of our Engineering team. We strive to continuously improve our products and appreciate any support we receive in ensuring the security of our customers' data. At the same time, we understand how tricky and difficult it can be to conduct IT security research and safely report findings in security and privacy matters. Therefore, we are committed to creating a safe environment to report vulnerabilities.

Once a legitimate report is submitted, we will review and fix the issue(s) as soon as we can. We aim to acknowledge reports within a few business days, and you will be updated by us once the review is finished. You must adhere to this Vulnerability Disclosure Policy and act in good faith to be eligible for a reward.

You do not need to ask us for permission before testing: research that follows this policy is authorised by it. We do not grant individual testing approvals beyond this policy. Any testing outside it requires a separate written agreement with re:cap.

Scope

Services provided directly by re:cap are in scope. These are:

1. Core (systems that hold customer, portfolio or staff data, or authenticate to them): app.re-cap.com, api.re-cap.com, auth.re-cap.com, mcp.re-cap.com and agents.re-cap.com.
2. Peripheral: www.re-cap.com.
3. Internal and staff systems: reporting a way into them is in scope, using it is not. If you obtain any access to these systems, or to any re:cap employee, investor or administrator account, stop immediately, do not use the access, and report it to us within 24 hours.

The following conditions are out of scope for the Vulnerability Disclosure Program and not eligible for a reward:

1. Any vulnerability obtained through the compromise of a re:cap customer or employee account.
2. Attacks that require an already compromised account, session or device.
3. Missing best practice, configuration or policy suggestions, for example missing security headers, email SPF, DKIM or DMARC settings, or self-XSS.
4. Missing rate limiting or CAPTCHA, unless you demonstrate a concrete security impact such as account takeover.
5. Token or session lifetime and invalidation behaviour (for example of links, tokens or sessions remaining valid after a newer one is issued), unless you demonstrate a concrete security impact such as account takeover.
6. Intended functionality, for example a feature fetching a public URL or website it is given. Requests that reach internal or private destinations remain in scope.
7. Any Denial of Service (DoS) attack against re:cap.
8. Physical attacks against re:cap employees, offices and data centers.
9. Social engineering of re:cap employees, contractors, vendors or service providers.
10. Knowingly posting, transmitting, uploading, linking to, or sending any malware.
11. Pursuing vulnerabilities which send unsolicited bulk messages (spam) or unauthorized messages.
12. Clickjacking on pages with no sensitive actions.
13. Any 3rd party vendor that re:cap uses (unless the vulnerability is found in the scope of re:cap's integration of said vendor).
14. Output from automated scanners without a working PoC to demonstrate a specific vulnerability.
15. Previously known vulnerable libraries without a working PoC.

Rules of engagement

Following these rules is a condition of the safe harbour and of any reward.

1. Use only accounts and companies you created yourself, and no more than two accounts. Do not access, modify or delete data that belongs to anyone else. Do not access or use internal systems. If you find a way in, stop and report it as described under Scope.
2. Stop at the first proof. Once you have shown that an issue exists, stop and report it. Do not use a finding to reach further data or systems.
3. If you encounter personal data, customer data or credentials, stop. Do not download or keep them, and tell us in your report what you saw.
4. Do not trigger production business processes beyond what a normal customer does with their own company, for example portfolio runs, bank or data connections using test connectors, payouts, or large numbers of assessments.
5. Do not put an unusual load on the re:cap systems: no denial of service, brute force or automated mass requests. Automated requests must not exceed 2 per second.
6. Once we have told you an issue is fixed or contained, do not continue testing it without our written agreement.
7. When you finish, remove what you can of what you created, and list the identifiers of any accounts, companies, connections or records in your report so we can remove the rest. Delete all data from our systems that you hold, and confirm the deletion in writing when we ask.

Eligibility and safe harbour

You must agree to our Vulnerability Disclosure Policy.

You must be the first person to responsibly disclose an unknown issue.

re:cap pledges not to initiate legal action against researchers as long as they act in good faith and adhere to the rules of engagement in this Vulnerability Disclosure Policy. Breaking those rules ends this pledge.

Keep the report, any data you encountered and our correspondence confidential. Do not publish or present anything about it, or use re:cap's name in connection with it, without our written consent. If you would like to publish, ask us and we will work out a version together.

Reports that withhold details until a reward is agreed, or that set a deadline or make a demand, are not eligible.

You must not violate any law. We reserve the right to cancel this program at any time.

Rewards

The decision to pay a reward is entirely at re:cap's discretion. There is no fixed schedule. We decide only after we have received and assessed the full report, based on severity, demonstrated impact and the quality of the report. We do not discuss rewards before we have the full report.

We do not pay for duplicates, issues already known to us, out-of-scope issues, or reports without a working proof of concept. Where we can, we tell you how we already knew about an issue.

To be eligible for a reward, you must be legally allowed in your jurisdiction to send an invoice to re:cap Technologies GmbH, Linienstraße 214, 10119 Berlin, Germany. The invoice must carry a reverse-charge note. We cannot pay rewards where sanctions law prohibits it. You are responsible for any tax implications or additional restrictions depending on your country and local law.

Contact

Please report your findings via email to security@re-cap.com. If you would like to encrypt your message using PGP, you can find the necessary information at https://www.re-cap.com/security/security.txt.

Submitting high quality reports is highly encouraged. Reports that are low quality and unclear may be closed without further response. Please include the following information in your report:

1. Affected target, feature or URL
2. Description of the problem
3. Impact of the issue
4. Steps to reproduce
5. The accounts and company IDs you used, your source IP addresses, and the time of your testing (UTC)
6. Any records you created, and any data belonging to others that you saw
7. Is this a publicly known issue?