IFS vulnerability disclosure policy

Guidance for reporting potential security vulnerabilities responsibly

A person in business attire holds a glowing orb with people icons inside, surrounded by abstract symbols of business.

Reporting a vulnerability

At IFS, we take security seriously. If you believe you have discovered a security vulnerability in an IFS product or service, please report it to us responsibly.

  • Scope

    This policy applies to publicly accessible IFS products, cloud services and websites that are owned or operated by IFS, unless a separate vulnerability disclosure process is provided for the relevant offering.

How to report

  • Send us the details

    Include as much information as possible:

    • Description of the vulnerability
    • Affected product, service and version
    • Steps to reproduce, if applicable
    • Potential impact
    • Any proof-of-concept or supporting materials
    Email the security team

  • Encrypt your message

    We recommend encrypting your message using our public key to protect sensitive vulnerability information.

    Download Public Key

Responsible research guidelines

When conducting security research

Coordinated disclosure

Please give IFS a reasonable opportunity to investigate and remediate the reported vulnerability before making any information public. We ask that you coordinate any proposed public disclosure with us in advance. The time required may vary depending on the complexity, severity and affected product or service.

Safe harbor

IFS supports security research conducted in good faith and in accordance with this policy. Where you make a good-faith effort to follow this policy, IFS will not initiate legal action against you in relation to your research.

This safe harbor does not authorize access to third-party systems or customer environments, does not waive applicable legal rights, and does not apply to conduct that is unlawful, causes harm, disrupts services or goes beyond what is reasonably necessary to identify and report a vulnerability.

What to expect

A purple gradient checkmark inside a circle on a black background.

Acknowledgment

We will acknowledge receipt of your report within five business days.

Investigation

We will investigate the issue and may contact you for additional information.

Remediation

If confirmed, we will work to remediate the vulnerability in accordance with our internal security and release processes.

Assessment

If we do not confirm the issue as a vulnerability, we will explain our assessment where appropriate.
Purple circular arrows icon representing reverse logistics

Progress updates

We will aim to keep you informed of material progress where reasonably possible.

Recognition and rewards

IFS does not currently operate a bug bounty program and does not guarantee financial rewards for vulnerability reports.

We appreciate responsible disclosure and the efforts of security researchers who help us improve the safety of our products.

More from the Trust Center