iwoca security reporting policy

iwoca understands the important role well-intentioned security researchers play in helping keep iwoca and our customers secure. We are committed to thoroughly investigating and resolving security issues in our platform. This policy outlines how iwoca and security researchers can work together to improve online security.

When to submit a bug/vulnerability

Bugs or vulnerabilities should be submitted in the following instances:

• The domain or subdomain is controlled by iwoca and exists within a domain that has a security.txt file linking to this document.

• It can be demonstrated that there would be a real impact to iwoca, its users or its customers should the vulnerability reported be exploited by a malicious actor. The existence of a vulnerability does not necessarily demonstrate that such a potential impact exists: theoretical impacts will not be considered as within the scope of this policy.

Please do not report vulnerabilities about the following:

• Volumetric/Denial of Service vulnerabilities (i.e. simply overwhelming our service with a high volume of requests);

• TLS configuration weaknesses (e.g. "weak" cipher suite support, TLS1.0 support, sweet32 etc.);

• Reports indicating that our services do not fully align with "best practice" (e.g. missing security headers or suboptimal email-related configurations such as SPF, DMARC etc.);

• Issues surrounding the verification of email addresses used to create user accounts;

• Clickjacking vulnerabilities;

• Self XSS (i.e. where a user would need to be tricked into pasting code into their web browser);

• CSRF where the resulting impact is minimal;

• CRLF attacks where the resulting impact is minimal;

• Host header injection where the resulting impact is minimal;

• Network data enumeration techniques (e.g. banner grabbing, existence of publicly available server diagnostic pages)

Bug bounty

iwoca does not have a published bug/value list, but we will work with researchers to agree a fair value on an individual basis. Rewards may be offered as a non-cash award.

We will not be able to consider any bug or vulnerability that has previously been submitted or been detected by our own internal procedures.

How to submit a bug:

Having understood the scope outlined above, please submit an email to security@iwoca.co.uk, including:

• The website or page in which the vulnerability exists

• A brief description and class of bug. Please do not submit full details that could be sensitive in the initial submission, we will contact you to arrange secure communications if required.

• Contact details so we can get back to you.

What Next?

Following submission, please allow 48 hours for us to acknowledge receipt of your email. If your submission is found to be in scope, we will respond, giving you a case reference and link to our support portal.

Our security teams will then work to triage the reported vulnerability and may contact you for further information. Please allow our security team up to 14 days to work through their process of assessment and remediation before re-contacting us about progress.

Once the security team has a solution, they will contact you to inform you and may ask for additional feedback.