Responsible Vulnerability Disclosure Policy
At Niice, the security of our systems and the privacy of our customers are top priorities. We are committed to maintaining a secure environment and we value the contributions of the security community.
If you have discovered a vulnerability in any of our systems, services, or applications, we appreciate your help in responsibly disclosing it to us.
Reporting a Vulnerability
If you believe you’ve found a security issue, please email us at security@niice.com with the following information:
- A detailed description of the vulnerability
- Steps to reproduce the issue (including relevant URLs, payloads, etc.)
- Your contact information (optional, if you’d like credit or a follow-up)
Our Commitments
When you report a vulnerability in good faith and follow this policy:
- We will not take legal action against you.
- We will work with you to understand and resolve the issue quickly.
Scope
This policy applies to:
Out of Scope:
The following types of findings are not considered in scope:
- Social engineering of our employees or customers
- Physical attacks against our offices or data centers
- Denial-of-service attacks
- Automated scanning without permission
- Issues related to outdated browser plugins or user-dependent vulnerabilities
Guidelines for Researchers
We ask that you:
- Avoid privacy violations, data destruction, or service disruption
- Avoid accessing or modifying data that does not belong to you
- Give us a reasonable amount of time to resolve the issue before disclosing it publicly
- Do not use automated tools that generate large volumes of traffic or alerts