Security & Responsible Disclosure

Investment Nerds values good-faith security research that helps protect our members, data and systems.

This Policy explains how security researchers may investigate and report potential vulnerabilities in Investment Nerds systems responsibly.

Security reports should be sent to security@investmentnerds.org.

This Policy does not authorise access to third-party systems, physical facilities, member accounts, personal information or infrastructure outside the scope described below.

Investment Nerds authorises good-faith security testing of systems expressly within scope, provided the researcher complies with this Policy.

Good-faith research means activity intended to identify and responsibly report a security vulnerability while avoiding harm to Investment Nerds, its users, data, systems and third parties.

Researchers must:

• act in good faith;
• use only the minimum testing reasonably necessary to demonstrate a vulnerability;
• stop testing when continued activity could cause harm;
• protect any information encountered;
• report vulnerabilities promptly and privately;
• provide reasonable time for investigation and remediation before public disclosure; and
• comply with applicable law.

Unless Investment Nerds publishes a more specific scope, good-faith testing is limited to publicly accessible web applications and APIs owned and operated by Investment Nerds under:

• investmentnerds.org and its Investment Nerds-operated subdomains; and
• other production domains that Investment Nerds expressly identifies in writing as within scope.

Development, staging, internal, administrative or infrastructure systems are not automatically in scope merely because they are discoverable.

Third-party services are not in scope unless Investment Nerds expressly states otherwise.

If you are uncertain whether a system is in scope, contact security@investmentnerds.org before testing it.

Within the defined scope, researchers may conduct limited, non-destructive testing reasonably necessary to identify and demonstrate vulnerabilities such as:

• authentication or authorisation flaws;
• access-control vulnerabilities;
• cross-site scripting;
• cross-site request forgery where security impact exists;
• injection vulnerabilities;
• server-side request forgery;
• insecure direct object references;
• exposure of sensitive information;
• security misconfigurations with demonstrable impact; and
• other vulnerabilities that present a credible security risk.

Testing must remain proportionate to demonstrating the issue.

This Policy does not authorise:

• denial-of-service or distributed denial-of-service attacks;
• traffic flooding, resource exhaustion or stress testing;
• destructive testing;
• deleting, corrupting or materially modifying data that is not yours;
• intentionally accessing another user's account;
• social engineering, phishing or impersonation;
• testing employees, contractors, moderators, Contributors or members;
• physical security testing;
• malware deployment;
• ransomware;
• persistence mechanisms or backdoors;
• credential stuffing;
• brute-force attacks likely to affect service availability or user accounts;
• large-scale automated scanning that materially degrades the service;
• spam;
• accessing more personal or confidential information than is minimally necessary to establish a vulnerability;
• downloading, copying or retaining bulk personal information;
• financial fraud or attempted financial transactions;
• market manipulation;
• accessing third-party systems without their permission; or
• publicly disclosing an unresolved vulnerability contrary to the coordinated disclosure process in this Policy.

If a vulnerability provides unintended access to data, stop after obtaining the minimum evidence reasonably necessary to demonstrate the issue.

Do not expand access to determine "how much" data is available.

Where testing requires an account, use an account you control.

Do not access, alter or attempt to take over another person's account.

Use test or synthetic data wherever reasonably possible.

Do not submit real financial credentials, passwords, PINs, one-time passwords, national identification information or other unnecessary sensitive information as part of testing.

If you unexpectedly encounter personal, financial, authentication or other sensitive information:

1. stop accessing the affected information;
2. do not download or retain more information than minimally necessary to document the vulnerability;
3. do not share the information with third parties;
4. securely protect any unavoidable evidence;
5. notify Investment Nerds promptly; and
6. delete retained sensitive evidence when Investment Nerds confirms it is no longer reasonably necessary, subject to applicable law.

Do not contact affected members directly unless Investment Nerds expressly asks you to do so or applicable law requires it.

Send reports to security@investmentnerds.org.

Include, where reasonably possible:

• the affected URL, endpoint or component;
• vulnerability type;
• a clear description of the issue;
• steps to reproduce it;
• expected and observed behaviour;
• security impact;
• screenshots, logs or proof-of-concept material where useful;
• any conditions required to reproduce the issue; and
• your preferred contact information.

Do not include unnecessary personal information or bulk user data in a report.

A concise proof of concept is preferable to exploitation beyond what is necessary to demonstrate impact.

Please give Investment Nerds a reasonable opportunity to investigate and remediate a reported vulnerability before publicly disclosing it.

Do not publish exploit details, proof-of-concept code or sensitive information while the issue remains unresolved without coordinating with Investment Nerds.

The appropriate remediation period depends on severity, complexity, dependencies and potential user impact.

Investment Nerds may request additional time where remediation reasonably requires it.

Investment Nerds should not use this process to unreasonably prevent responsible public discussion after a genuine opportunity to address the issue.

For reports that comply with this Policy, Investment Nerds will seek to:

• acknowledge receipt within a reasonable period;
• review and triage the report;
• communicate where additional information is needed;
• investigate credible vulnerabilities;
• take remediation steps appropriate to the risk; and
• communicate significant status changes where reasonably practicable.

Investment Nerds does not guarantee a particular remediation timeline.

Where a researcher complies with this Policy and acts in good faith, Investment Nerds will not initiate legal action against the researcher solely for the authorised security research described by this Policy.

If Investment Nerds concludes that research was conducted consistently with this Policy, it will seek to treat that activity as authorised for purposes within Investment Nerds' control.

This assurance does not:

• bind third parties;
• authorise violations of applicable law;
• protect conduct outside this Policy;
• authorise access to systems Investment Nerds does not control;
• waive the rights of affected users or third parties; or
• protect fraud, extortion, threats, data theft, destructive conduct or other malicious activity.

When uncertain whether proposed testing is permitted, contact security@investmentnerds.org before proceeding.

Do not threaten to publish, sell, exploit or withhold vulnerability information in order to obtain money, employment, services or another benefit.

A request for recognition or an inquiry about whether a reward programme exists is not by itself prohibited, but disclosure must not be conditioned on payment.

This Policy does not establish a bug-bounty programme and does not promise payment, rewards or compensation for vulnerability reports.

Investment Nerds may introduce a separate bounty or recognition programme in the future. Any such programme will have its own scope, eligibility, reward and payment terms.

Do not assume a vulnerability is eligible for compensation unless Investment Nerds has expressly published applicable bounty terms.

Investment Nerds may receive multiple reports of the same issue.

Acknowledgement of a report does not mean that Investment Nerds accepts the reported issue as a vulnerability or agrees with its stated severity.

Examples of reports that may receive lower priority include issues with no meaningful security impact, purely informational findings, unsupported scanner output, previously reported vulnerabilities and vulnerabilities entirely within third-party systems.

Investment Nerds may rely on third-party hosting, authentication, communications, payment, analytics or infrastructure services.

This Policy does not grant permission to test those providers.

Where a vulnerability appears to affect a third-party service used by Investment Nerds, report it to security@investmentnerds.org without conducting unauthorised testing of the third party.

The third party's own security or disclosure policy may separately apply.

Information shared with Investment Nerds through a vulnerability report may be used to investigate, reproduce, remediate and document the issue, protect users, comply with law, and coordinate with relevant service providers.

Investment Nerds will seek to handle reporter information and vulnerability details appropriately, but cannot promise absolute confidentiality where disclosure is required by law or reasonably necessary for remediation or protection of users.

Investment Nerds may, with a researcher's permission, acknowledge researchers who provide useful good-faith reports.

Recognition is discretionary and does not create employment, agency, partnership or entitlement to compensation.

Investment Nerds may update the scope or terms of this Policy as its systems, security programme and legal obligations evolve.

Researchers should review the current Policy before beginning new testing.

Changes do not retroactively convert activity that complied with the applicable Policy at the time into prohibited activity.

Security vulnerabilities and responsible-disclosure questions: security@investmentnerds.org

General support: support@investmentnerds.org

Investment Nerds. Accra, Ghana · Web: investmentnerds.org