Purpose of this policy
We value the work of security researchers. This policy authorises you to look for vulnerabilities in our services, provided you act in good faith and follow the rules below, and explains how to report what you find.
The policy covers the PIXEL LORIS IT SERVICES L.L.C. services listed under “What you may test”. If you have a separate testing agreement with us, the terms of that agreement take precedence.
What you may test
You may test the websites, web applications and APIs at the following addresses:
- plasmaedtech.com and www.plasmaedtech.com: the Plasma EdTech website;
- plasmida.ai and www.plasmida.ai: the Plasmida.ai personal AI tutor;
- plasmalearn.com and www.plasmalearn.com: the Plasma [Learn] LMS.
Test other subdomains or services that appear to belong to us only after we have confirmed it in writing.
Out of scope
Do not test:
- third-party services we use, such as Cloudflare, Telegram, Google Maps, Medium, publishers’ websites and our email and hosting providers; report issues in them to their owners;
- our offices, equipment and staff;
- other users’ accounts and data.
What is permitted
Under this policy, you may:
- look for vulnerabilities manually and with automated scanners, keeping the load below 10 requests per second per service, and stop scanning at once if the service starts returning errors or slows down;
- create test accounts where the service allows it, and interact only with those accounts and your own data;
- confirm a vulnerability with a minimal proof of concept using your own test accounts and data, then stop.
To help us recognise your traffic, add an X-Security-Research header containing your email address or handle to your requests where possible.
What is not permitted
Even with good intentions, you must not:
- launch denial-of-service (DoS or DDoS) attacks or run load tests;
- use social engineering, including phishing, calls or messages to our staff, partners or users;
- attempt to gain physical access to our offices or equipment;
- access other people’s accounts or data in any way, including viewing, modifying, deleting, downloading or sharing them;
- establish persistence, for example with backdoors, web shells or hidden accounts, or move laterally through our infrastructure;
- send spam or mass emails, messages or form submissions;
- test services not listed under “What you may test”;
- disclose details of a vulnerability before it is fixed or before the agreed date.
If you accidentally access someone else’s data, stop testing, do not keep or share the data, and tell us immediately.
How to report a vulnerability
Email [email protected] with the subject “Vulnerability report”. You can write in English, Russian or Arabic. Please include:
- the URL or component affected;
- a description and the type of vulnerability;
- steps to reproduce it and evidence such as requests, responses, screenshots or a video;
- your assessment of the impact;
- how to contact you and how you would like to be credited, if at all.
Do not attach real users’ personal data. If you need a secure channel to send your report, let us know and we will arrange one.
Our commitments
When we receive your report, we will:
- acknowledge it within 3 business days;
- share our initial assessment within 10 business days;
- keep you informed as we work on a fix;
- with your permission, credit you publicly once the issue is fixed.
This programme does not currently offer monetary rewards.
Safe harbour
If you follow this policy in good faith, we consider your testing authorised. We will not take legal action against you or report you to law enforcement for that testing, and if a third party brings a claim, we will confirm that you acted with our permission.
This policy cannot authorise anything prohibited by law, including UAE cybercrime legislation and the laws of the country where you are. If you are unsure whether an action is allowed, ask us before you start testing.
Public disclosure
We follow coordinated disclosure. Please do not publish details of a vulnerability until it has been fixed. We aim to fix vulnerabilities within 90 days of a report; if we need more time, we will agree a publication date with you.
Changes to this policy
We may update this policy; the current version and its date are always published on this page. Testing started under an earlier version is assessed under that version. Our contact for researchers is also listed in the website’s security.txt file, following RFC 9116.