How to report
Write to the data protection officer, in English or Ukrainian. Include:
- the page address or component affected;
- the steps to reproduce it;
- what an attacker could do and whose data is at risk;
- evidence: screenshots, requests and responses;
- how to reach you.
What is in scope
- the ugla.ua website;
- UGLA ERP and the other UGLA services on subdomains of ugla.ua.
Third-party services the website uses (Calendly, Google, Meta, YouTube, for example) are not covered by this policy: report their vulnerabilities to them.
Rules
- Test only on your own account, or on a test account if we have given you one.
- Do not open, change or delete other people's data. If you reach someone else's data by accident, stop, do not keep it, and tell us.
- Do not overload the services: no denial-of-service attacks, load tests or mass automated scanning.
- No social engineering, no phishing of our staff or customers, and no physical access.
- Do not disclose details until the vulnerability is fixed, or until we have agreed otherwise with you.
What we do with a report
- We confirm we have received it.
- We assess the risk under our vulnerability management procedure: how severe the vulnerability is, how easy it is to exploit and what it affects.
- We set the actions and the deadlines and assign an owner; critical and high vulnerabilities are fixed first.
- We tell you the outcome and confirm when the vulnerability is fixed.
- If the vulnerability affected personal data, we follow the incident procedure described in the Privacy Policy.
Good-faith research
If you follow these rules and act in good faith, we will treat your research as authorised, will not take legal action or go to the police over it, and will work with you to understand and fix the problem.
This policy is also published for automated tools in /.well-known/security.txt (RFC 9116).