Found a vulnerability? Email security@intercept.com.sa. Encrypt sensitive details with our PGP key, available on request. Please give us a reasonable opportunity to remediate before any public disclosure.
Our commitment
Security is what we build, so we hold our own systems to the standard we ask of others. We welcome reports from security researchers and will work with you in good faith to understand, validate, and fix issues quickly. This policy explains what we consider in scope, how to report, and what you can expect from us.
Safe harbor
If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorized, will not pursue or support legal action against you, and will work with you to understand and resolve the issue. If a third party brings legal action against you for research conducted in line with this policy, we will make it known that your actions were authorized. This safe harbor does not apply to activity that violates the rules of engagement below or applicable law.
Scope
The following are in scope:
- The intercept.com.sa website and its subdomains.
- The Intercept platform and its documented APIs, tested against your own authorized account or a test tenant.
Report anything that could affect the confidentiality, integrity, or availability of our systems or customer data — including authentication and authorization flaws, injection, tenant-isolation gaps, sensitive-data exposure, and vulnerabilities in the way we sign or verify evidence.
Out of scope
The following generally do not qualify: reports from automated scanners without a demonstrated, exploitable impact; volumetric denial-of-service; social engineering, phishing, or physical attacks against our staff or offices; missing best-practice hardening headers with no security impact; and vulnerabilities in third-party services we do not control. Never access, modify, or exfiltrate data that is not yours, and never disrupt production service.
How to report
Send your report to security@intercept.com.sa. A useful report includes:
- A clear description of the vulnerability and its potential impact.
- Step-by-step instructions to reproduce it, including affected URLs or endpoints.
- Proof-of-concept code, requests, or screenshots where helpful.
- Any accounts or test data you used, so we can retrace your steps.
What to expect
We aim to acknowledge your report within two business days, validate and triage it promptly, and keep you updated as we work toward a fix. We will let you know when the issue is resolved and, with your permission, credit you for the discovery. Remediation timelines depend on severity and complexity; we will be transparent about ours.
Rules of engagement
- Only test accounts and data that belong to you or that we have authorized you to use.
- Stop at proof of concept — do not pivot, escalate, or access data beyond what is needed to demonstrate the issue.
- Do not run automated scanning that degrades service, and do not perform denial-of-service testing.
- Keep vulnerability details confidential until we confirm a fix is released, and coordinate any public disclosure with us.
- Comply with all applicable laws.
Recognition
We do not currently operate a paid bug-bounty program, but we deeply value the researchers who help keep our customers safe. With your consent, we are glad to acknowledge your contribution publicly once an issue is resolved.
Contact
Reach the security team at security@intercept.com.sa. For non-security enquiries, please use our contact page.