Security

FundingPartner welcomes contributions, suggestions and vulnerability reports from security researchers. We understand that independent security research plays a vital role in identifying vulnerabilities and improving overall security, and we want to ensure that such research is conducted ethically and responsibly so all parties may benefit.

Code of conduct

We encourage security researchers interested in examining our systems to comply with the code of conduct outlined in the OWASP Vulnerability Disclosure Cheat Sheet. In particular, we hold ourselves to the following standard and expect security researchers to do the same:

Researchers should:

Ensure that any testing is legal and authorised.
Respect the privacy of others.
Make reasonable efforts to contact the security team of the organisation.
Provide sufficient details to allow the vulnerabilities to be verified and reproduced.
Not demand payment or rewards for reporting vulnerabilities outside of an established bug bounty program.

Organisations should:

Provide a clear method for researchers to securely report vulnerabilities.
Clearly establish the scope and terms of any bug bounty programs.
Respond to reports in a reasonable timeline.
Communicate openly with researchers.
Not threaten legal action against researchers.
Request CVEs where appropriate.
Publish clear security advisories and changelogs.
Offer rewards and credit.

Scope and requirements

Submissions that demonstrate clearly how a vulnerability can be exploited in practice and can point to real impact will be prioritised. A reproducible proof of concept (PoC) is required.

The following types of submissions are likely to be disregarded:

Reports that are clearly LLM-generated
Reports produced by automated scanners
“Beg bounty” submissions
Reports of trivial or non-issues

Contact information

General inquiries may be sent to security@fundingpartner.no. Sensitive matters such as vulnerability disclosures should be sent by encrypted email to fundingpartner@protonmail.com using the following PGP key:

Fingerprint: 955fea38d8ad047aa8124dff07f9aad15578b616

Rewards

FundingPartner does not currently operate a formal bug bounty program. Financial rewards for bona fide vulnerability reports may be granted on a discretionary basis.