Skip to content
Client Login Start a project
Security

Responsible disclosure.

Help us identify and investigate potential security vulnerabilities affecting Specicon’s systems and services.

Send a clear, reproducible report.

Include the affected service, steps to reproduce the issue, observed behavior, potential impact, and any relevant supporting information. Please avoid sending unnecessary personal information or sensitive customer data.

Email
contact@specicon.com
Secure communication
A supported secure method or verified encryption key, where available
Acknowledgment
The security team confirms receipt and communicates next steps

Systems covered by this policy.

  • Decision API. Specicon’s decision API and supported public endpoints, where explicitly authorized for testing.
  • Customer access. Customer authentication and account interfaces designated as in scope.
  • Public website. Specicon’s public website and explicitly designated subdomains.
  • Published software. Software packages and integration components maintained by Specicon and explicitly included in the policy.

Activities that may disrupt services or affect others.

  • Denial-of-service and resource-exhaustion testing.
  • Social engineering involving employees, customers, or vendors.
  • Testing that accesses, modifies, or exposes information belonging to other users.
  • Findings involving third-party services outside Specicon’s authorized scope.
  • Automated scan reports without demonstrated security impact.

Reports reviewed according to their impact.

We assess reported vulnerabilities, investigate reproducible findings, prioritize remediation according to severity, and communicate relevant updates through the reporting process. Recognition of researchers and any publication arrangements are discussed according to the circumstances of the report.

Test responsibly.

  • Use only accounts, data, and environments you are authorized to access.
  • Avoid destructive testing or activity that could interrupt services.
  • Stop testing and report the issue if you encounter another person’s information or evidence of a significant vulnerability.
  • Allow reasonable time for investigation and remediation before public disclosure.