== Responsible Disclosure Policy - eSky == === Our Commitment to Security === At eSky, we recognize that no technology is perfect. We believe that collaboration with skilled security researchers globally is essential for identifying and addressing potential vulnerabilities in our systems. We value the security community's efforts in helping us protect our services and our customers. If you believe you've discovered a security vulnerability in an eSky product or service, we encourage you to report it to us promptly. We are committed to working with you to understand and resolve the issue in a timely manner. === Safe Harbor === eSky will not initiate legal action against individuals who discover and report security vulnerabilities in accordance with this Responsible Disclosure Policy. We consider activities conducted consistent with this policy to constitute "authorized" conduct under the Computer Fraud and Abuse Act (CFAA) and similar laws. We waive any potential claims against you for circumventing technological measures when your activities are conducted in accordance with this policy. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy. We ask that you, in turn: - Make a good faith effort to adhere to this policy. - Do not intentionally harm the availability or usability of our services. - Do not view, modify, access, or destroy data belonging to eSky or our users. - Do not disclose the vulnerability details publicly or to third parties until we have had a reasonable opportunity (typically 90 days from our acknowledgement of your report) to address the issue, unless we agree otherwise in writing. - Do not perform any research or testing in violation of applicable laws. === Code of Conduct / Rules of Engagement === To ensure the safety and privacy of our users and the stability of our services, please adhere to the following rules when conducting your research: - No Denial of Service: Do not perform any actions that could disrupt access to our services (e.g., Network-level DDoS/DoS, Application volumetric DDoS/DoS). If you find a request that causes performance issues, please report it without attempting to exploit it further to cause a denial of service. - Respect User Data: Do not attempt to access, modify, or damage data belonging to other users. All testing must be confined to accounts you own or have explicit permission to test. If you inadvertently access private customer data, stop testing immediately and notify us. - No Social Engineering: Do not engage in social engineering attacks (e.g., phishing, vishing, smishing) against eSky employees, contractors, or users. - No Automated Scanning: Avoid using high-volume automated vulnerability scanners against our services, as they can impact performance and availability. Targeted, careful testing is preferred. - Legal Compliance: Ensure all your testing activities comply with applicable laws and regulations. - Employee Exclusion: Current eSky / eDestinos employees and contractors, as well as those who have been employed within the past six months, are not eligible to participate in this program. == Scope == This policy applies to security vulnerabilities found within the following eSky assets: === In-Scope === - *.esky.pl - *.esky.com - *.eskyservices.pl - www.thomascook.com Note: The wildcard (*) applies to subdomains directly managed by eSky, unless explicitly listed as out-of-scope or pointing to uncontrolled third-party services. === Out-of-Scope === - cars.esky.* (e.g., cars.esky.com, cars.esky.pl) - wczasy.esky.pl - samochody.esky.pl - parkingi.esky.pl - eSky / eDestinos mobile applications (iOS and Android) - *.edestinos.com (and its subdomains, e.g., *.edestinos.com.br) - *.eskytravel.* - Any third-party services or domains not explicitly listed as in-scope. - Recently disclosed zero-day vulnerabilities (please allow us at least 14 days to patch before reporting). Any suspicious activities directed towards out-of-scope assets may result in defensive actions, including blocking. === Reporting a Vulnerability === If you believe you have found a qualifying vulnerability, please submit your report via email to: security@esky.com. === What Makes a Successful Report? === To help our security team assess and validate your finding efficiently, please include the following in your report: 1. Clear Description: Detailed description of the vulnerability. 2. Steps to Reproduce: Precise steps required to reproduce the vulnerability. Include URLs, parameters, and any necessary setup. 3. Proof of Concept: Verifiable proof, such as screenshots, videos, or scripts demonstrating the vulnerability. Please avoid sending executable files; provide code snippets or descriptions instead. 4. Environment: Details of your testing environment (e.g., browser version, operating system, relevant tools). 5. Impact Assessment: Your assessment of the potential impact of the vulnerability on eSky or its customers. Explain the attack scenario and potential consequences. === Our Process & Response Times === 1. Acknowledgement: We aim to acknowledge receipt of your report within 5 business days. 2. Assessment: Our security team will review the report to validate the vulnerability, assess its severity, and determine if it qualifies under this policy. This process can take up to 30 days, potentially longer for complex issues. 3. Remediation: If the report is validated, we will prioritize remediation based on the severity and impact. 4. Notification: We will notify you once the vulnerability has been addressed. We aim to keep you informed of our progress. == Rewards & Recognition == eSky values the contributions of security researchers. Please note that eSky does not operate a private or invitation-only Bug Bounty program at this time. This policy outlines our public Responsible Disclosure process. Furthermore, please note that this Responsible Disclosure Program does not offer monetary rewards. - General Policy: This program generally does not provide rewards for submitted vulnerabilities. - Exceptions: In exceptional circumstances, for findings with a particularly high security impact, the eSky security team may, at its sole discretion, decide to grant an award. This decision is based on factors including vulnerability impact, severity, quality of the report, and adherence to this policy. - Reward Types (for Exceptions): If an exception is made and an award is granted, it will be in the form of eSky SWAG (branded merchandise) or an eSky Wallet top-up. No other forms of reward (including monetary compensation or travel vouchers) will be offered. - Duplicate Issues: Vulnerabilities that have already been reported, are already known to us, or result from the same underlying issue as a previously reported vulnerability are generally not eligible for an award, even if an exception is considered. == Ineligible Submissions & Findings == The following types of findings are generally considered out-of-scope or ineligible for rewards/awards under this program: - Findings already submitted by another researcher, already known to eSky, or classified as acceptable risk/not applicable. - Theoretical vulnerabilities without practical exploitability or proof of concept. - Self-exploitation issues (e.g., Self-XSS, manipulating your own account data without impacting others). - Presence of browser 'autocomplete' or 'save password' functionality. - Clickjacking vulnerabilities. - Intended functionality issues (e.g., session duration policies, password reset email behavior). - Missing best-practice security headers (e.g., HSTS, CSP, X-Frame-Options) unless you demonstrate a direct, practical exploit. - Missing cookie flags (HttpOnly, Secure, SameSite) unless you demonstrate a direct, practical exploit. - TLS/SSL configuration issues (e.g., weak ciphers, expired certificates, protocol best practices). - Incomplete or missing SPF, DKIM, or DMARC records. - Information disclosure of non-sensitive data (e.g., server banners, software versions, public files). - Denial of Service (DoS/DDoS) vulnerabilities or Rate Limiting issues. - Findings dependent on outdated browsers, plugins (e.g., Flash), or operating systems. - Cross-Site Request Forgery (CSRF) on unauthenticated pages or actions with minimal security implications (e.g., login/logout CSRF). - Password complexity, account lockout, or password length policy suggestions. - Physical security issues. - Social engineering attacks. - Results directly from automated scanning tools without manual validation and proof of exploitability. - Vulnerabilities requiring physical access to a user's unlocked device. - Bugs that do not pose a security risk (please report these to contact@esky.com). - Vulnerabilities requiring extremely unlikely user interaction. - Brute-force attacks against login endpoints or other resources. - All findings related to WordPress installations (unless demonstrating a critical impact beyond standard WordPress vulnerabilities). --- We appreciate your contribution to keeping eSky and our users safe. Thank you for your collaboration!