Vulnerability Disclosure Policy

Introduction

Gas Management Services Limited’s (“GMSL” or “we”) take the security of our services and products seriously. We are strongly committed to safeguarding our customers. This Vulnerability Disclosure Policy applies to any vulnerabilities you are considering reporting to GMSL. We recommend reading this vulnerability disclosure policy fully before you report a vulnerability and always act in compliance with it.

We value those who take the time and effort to report security vulnerabilities according to this policy. We appreciate deeply your time and contribution.

How to Report

If you believe you have found a security vulnerability, please fill in the GMSL Vulnerability Disclosure Webform below and submit it to us.

In your report, please fill in all the mandatory sections and provide any other additional information that you wish to disclose. This helps to ensure that the report can be triaged quickly and accurately. It also reduces the likelihood of duplicate reports, or malicious exploitation of some vulnerabilities.

What to Expect Next

Your report is then triaged and assessed by us. Priority for remediation is assessed by looking at the impact, severity and exploit complexity. Vulnerability reports might take some time to triage or address. You might be contacted for further information regarding the vulnerability if we find it necessary.

We will notify you when the reported vulnerability is remediated, and you may be invited to confirm that the solution covers the vulnerability adequately. If instead, the report is assessed not to be a vulnerability, we will also notify you about the decision.

Code of Conduct

We expect you not to:

  • Break any applicable laws or regulations
  • Access data beyond what is necessary for the intended purpose
  • Use high-intensity invasive or destructive scanning tools to find vulnerabilities
  • Disrupt GMSL’s services or systems
  • Submit reports detailing non-exploitable vulnerabilities, or reports indicating that the services do not fully align with “best practice”, for example missing security headers
  • Publicly disclose any vulnerabilities or associated information
  • Spamming/social engineering/phishing attacks
  • Demand financial compensation for disclosing any vulnerabilities

Privacy Notice

If you wish to disclose your name, email address or name of your company in the report, we will collect them and retain such information for administrative purposes . We will use this information to track future correspondence during the investigation of the reported vulnerability. For more information on how we may process your personal data, please read the GMSL Privacy Policy.

    GMSL Vulnerability Report

    Fields marked with * are mandatory.

    By submitting this report, you are agreeing to the GMSL Vulnerability Disclosure Policy.