Vulnerability Disclosure Policy (VDP)

1 Introduction

At Scatter Instruments, the security of our systems and the protection of our customer data is a top priority. We value the role of independent security researchers in helping us maintain a high standard of security.

We are committed to working with the security community to resolve verified vulnerabilities in a timely and responsible manner.

2 Safe Harbor

Scatter Instruments will not initiate legal action against individuals who discover and report security vulnerabilities in accordance with this policy. We consider security research conducted under this policy to be authorized.

To be protected by this Safe Harbor, you must:

• Comply with all rules and guidelines in this policy
• Not compromise the privacy or safety of our customers and their data
• Not disrupt or degrade our services in any way
• Act in good faith to avoid privacy violations, destruction of data, and interruption of our services

3 Scope

This policy applies to the following publicly accessible websites and services owned by Scatter Instruments:

In-Scope Systems

• scatterinstrumentsonline.com
• www.scatterinstrumentsonline.com
• Any other subdomains of scatterinstrumentsonline.com

Out-of-Scope Systems & Actions

Any service not explicitly listed as in-scope is considered out of scope. The following actions are strictly prohibited:

• Testing on third-party services (payment processors, analytics providers, social media widgets)
• Physical attacks against our facilities or equipment
• Social engineering (phishing, vishing) of our employees, contractors, or customers
• Denial of Service (DoS or DDoS) attacks
• Posting spam or using automated tools to aggressively crawl our site
• Accessing, modifying, or exfiltrating data that does not belong to you

4 How to Report a Vulnerability

If you believe you have found a security vulnerability, please submit your report via email at contact@scatterinstruments.com.

For sensitive information, we encourage you to encrypt your report using our PGP key, available in our security.txt file.

A great report should include:

• A clear and descriptive title
• The type of vulnerability and its potential impact
• The full URL or asset where the vulnerability was discovered
• Detailed, step-by-step instructions to reproduce the issue
• Any proof-of-concept code, screenshots, or screen recordings

5 Our Commitment

When you report a vulnerability in accordance with this policy, we promise to:

• Acknowledge receipt of your report within 2–3 business days
• Provide you with a point of contact and keep you updated on our progress
• Investigate and validate your report
• Remediate verified vulnerabilities as soon as reasonably possible
• Not publicly disclose the details of the vulnerability until a fix is in place

6 Rewards & Recognition

While Scatter Instruments does not currently offer monetary bug bounties, we are deeply grateful for the community's contributions.

For verified and qualifying vulnerability reports, we offer public recognition on our Security Researcher Hall of Fame, with your permission.