This is a courtesy translation. In case of any discrepancy, the Spanish version prevails. Read the Spanish version
As a technology company, PRONETSYS S.A.S. (hereinafter, “Pronetsys” or “the Company”) recognizes the value of the work of security researchers and of anyone who, in good faith, identifies a vulnerability in its systems. This Policy explains which systems may be analyzed, how to report a finding and what you can expect from the Company.
The goal is to fix vulnerabilities before they can be exploited, through a coordinated disclosure process that protects users, customers and those who report.
1. Scope
This Policy applies to the following assets, operated directly by the Company:
| Asset | Remarks |
|---|---|
| Corporate website https://pronetsys.com.co | Includes its public pages and forms. The login page of the administrative portal is included, but brute-force attacks and attempts to guess credentials are not permitted. |
| Support portal https://soporte.pronetsys.com.co | Configuration or implementation errors attributable to the Company. Vulnerabilities in the help desk software itself must also be reported to its project or vendor. |
| Other subdomains of the corporate website operated by the Company | If you are unsure whether a subdomain is included, ask before testing. |
2. Out of scope
The following activities and systems are excluded from this Policy and are not authorized:
- Denial-of-service attacks (DoS or DDoS), load or stress testing, and any action that degrades the availability of the services.
- Social engineering, including phishing, vishing or impersonation targeting the Company’s employees, customers or suppliers.
- Physical security testing of the Company’s equipment, its staff members’ workplaces, its suppliers’ data centers or its customers’ premises.
- Mass sending of messages or test reports through the contact form, the Ethics Hotline or the customer service channels.
- Systems, websites, applications or servers belonging to the Company’s customers, even if they are hosted, managed or supported by the Company. Testing those systems requires the authorization of their owner.
- Third-party services, such as WhatsApp, Google, Microsoft, cloud infrastructure providers and the external store or catalog linked from the site, which must be reported to the parties responsible for them.
As a general rule, the following findings are not considered vulnerabilities requiring handling under this Policy either, unless a real and exploitable impact is demonstrated:
- Results of automated scanners without manual validation.
- Missing security headers or cookie attributes without a concrete exploitation scenario.
- Disclosure of software versions or of error messages without sensitive information.
- Clickjacking on pages without sensitive actions, or self-XSS.
- SPF, DKIM or DMARC record configurations without a demonstration of effective spoofing.
If you find a vulnerability in a system belonging to a customer of the Company, you may report it to soporte@pronetsys.com.co without performing further testing. The Company will forward it to the customer when it provides services related to that system.
3. How to report a vulnerability
Send your report to the security email address soporte@pronetsys.com.co, in Spanish or English. To facilitate the assessment, include:
- Description. Type of vulnerability and affected asset (URL, parameter, component or subdomain).
- Steps to reproduce it. Clear instructions and, if possible, a proof of concept that causes no harm and does not access third-party data.
- Impact. Your assessment of the potential impact and of the exploitation scenario.
- Evidence. Screenshots, HTTP requests and responses or relevant logs, without including third parties’ personal data.
- Contact. A means of communicating with you and, if you wish, the name under which you want to be credited.
You may report anonymously; however, without a means of contact the Company will not be able to inform you of progress or ask you for clarification. If an encryption key is published in the security.txt file, we recommend using it to send sensitive information.
4. Response commitments
Upon receiving a report that complies with this Policy, the Company undertakes to:
| Stage | Timeframe | Description |
|---|---|---|
| Acknowledgment of receipt | Up to 3 business days | Confirmation that the report was received, with a reference number. |
| Initial assessment | Up to 10 business days | Validation of the finding, classification of its severity and communication of the decision on how it will be handled. |
| Follow-up | At least every 15 business days | Periodic updates on the progress of the fix until it is closed. |
| Closure | Depending on severity and complexity | Notice of the fix or of the mitigation measures adopted, and coordination of the disclosure. |
The Company will prioritize the fix according to the severity and risk of the finding, and will treat the report and the identity of the person who submits it as confidential. If the vulnerability affects customers, the Company will inform them of what is necessary for them to adopt protective measures.
5. Coordinated disclosure
Reporters are asked not to publicly disclose the vulnerability or share it with third parties until the Company confirms that it has been fixed or until ninety (90) calendar days have elapsed since the report, whichever occurs first, unless the parties agree on a different timeframe. If the fix requires more time, the Company will explain the reasons and propose a new date.
Before any publication, reporters are asked to share the draft with the Company to verify that it does not include information that puts users or customers at risk.
6. Rules for research
For research to be considered in good faith and covered by this Policy, the person conducting it must:
- Limit testing to the in-scope assets and use only their own accounts or test accounts.
- Not access, modify, delete or encrypt third-party data, and not alter the configuration of the systems.
- Not extract or retain information; demonstrate the vulnerability with the minimum amount of data necessary.
- Stop immediately upon encountering personal data, confidential information or credentials, not explore them any further, report the finding and delete any copy they may have obtained.
- Not use the vulnerability to obtain additional access, move laterally or maintain persistence.
- Avoid actions that affect the availability, integrity or performance of the services, and limit the rate of automated requests.
- Report the finding without undue delay and respect the coordinated disclosure period.
- Not demand payment or make the delivery of information conditional on a reward.
- Comply with applicable law.
7. Safe harbor
The Company considers security research conducted in good faith and in accordance with this Policy to be authorized. With respect to such research, the Company:
- Will not initiate legal action or file criminal complaints against the person who conducted it.
- Will not consider it a breach of the website’s Terms and Conditions.
- If a third party initiates action related to the research, will make known that it was conducted in accordance with this Policy.
This commitment only covers activities carried out on the in-scope assets and in accordance with the rules of this Policy. It does not bind third parties or the authorities, and it does not authorize testing of customers’ or other providers’ systems. If you are unsure whether an activity is permitted, ask soporte@pronetsys.com.co beforehand.
8. Recognition
The Company does not offer a monetary reward program (bug bounty). Any monetary compensation will only apply if there is a prior written agreement with the Company.
As a token of appreciation, and with the reporter’s consent, the Company may publicly acknowledge their contribution once the vulnerability has been fixed, using the name or pseudonym that person indicates.
9. security.txt file
Contact information for security reports is also published in the /.well-known/security.txt file, in accordance with the IETF RFC 9116 standard. That file indicates the contact channel, the link to this Policy and its expiration date, and it is updated periodically.
10. Legal framework
This Policy is framed within Colombian law, in particular Law 1273 of 2009, which protects information and data and defines computer crimes, and Statutory Law 1581 of 2012, on personal data protection. Activities that exceed the scope or the rules of this Policy are not considered authorized by the Company.
11. Processing of the reporter’s data
The personal data provided by the reporter will be used solely to manage the report, communicate with that person and, if they authorize it, acknowledge their contribution, in accordance with the Personal Data Processing Policy.
12. Effective date and updates
This Policy is effective from its publication and may be updated to reflect changes in assets, processes or regulations. Reports will be handled in accordance with the version in force on the date they are received. For other information security matters, see the Information Security Policy.