Keeping your information safe

What you will do:

1. Act responsibly for the sole purpose of reporting suspected vulnerabilities and safeguarding users from damage, harm or loss.
2. Avoid causing any kind of damage, harm or loss to individuals or organisations (e.g. you should not attempt to test, reproduce or verify the suspected vulnerability, or take any action which may cause interruption or degradation of any Services).
3. Conduct yourself in accordance with applicable laws and regulations at all times. If you have any doubt about such laws or regulations, please seek and obtain professional legal advice. Under no circumstances should you attempt to exfiltrate any computer data or publish details of any suspected vulnerability.
4. Upon detection of a suspected vulnerability, notify us immediately or as soon as practicable by submitting a report. You may encrypt your emails to us using our PGP key.
5. Provide adequate information in the suspected vulnerability report so that we may work with you on validating the suspected vulnerability.

You will NOT

1. Act in any way which may contravene applicable laws and regulations (e.g. the Computer Misuse Act).
2. Publish or publicly disclose any suspected vulnerability to any third party before it is resolved as malicious actors may exploit the suspected vulnerability to cause damage, harm or loss to individuals and organisations.
3. Deploy destructive, disruptive or other unlawful means to detect vulnerabilities (e.g. attacks on physical security, social engineering, denial of service, brute force attacks).
4. Exploit, test or otherwise use any suspected vulnerability (e.g. taking any step(s) to access, copy, create, delete, modify, manipulate or download any data or programme, build system backdoor(s), modify system configuration(s), facilitate or share system access)

One of our qualified team members will assess the Finding using a methodology based on OWASP’s Risk Rating Methodology. These findings shall be shared with you for either your acceptance or comment. If you accept then we’ll move on to payment.

If you make comments on the assessment, the assessment and comments shall be reviewed by a different team member for final assessment. Upon completion of a final assessment we shall also proceed to payment.

TruTrip have the right to determine severity classifications, report validity, duplications, exclusions, and out-of-scope bugs in its sole discretion.

We shall pay out rewards based on the following criteria

Rates as of 1st August 2021. TruTrip reserves the right to decrease or increase any Rate based on our own assessment of impact. Prior Rates are not precedent for future payments.

Payment is typically made within 14 days of submitting a finding. We currently make payments via the Wise payment infrastructure, typically this will go directly into your bank account or Wise account if you have one, and we cover any associate fees. If you require payment outside of the Wise infrastructure, we will deduct any associated fees from your reward.

We will not issue Rewards for

• Findings already identified. Please see this list for known issues.
• Findings relating to 3rd-party systems.
• Findings which enumerate already claimed handles, emails and other such information. This reveals no sensitive information, regardless of whether the associated profiles are public or private.
• Findings related to Distributed Denial of Service (DDos).

If you have any other queries relating to our Vulnerability Disclosure Programme, please contact us and we will endeavour to help.