Nuri GmbH believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we appreciate your help in disclosing it to us in a responsible manner. We welcome working with you to resolve the issue promptly.

We’ll work with you to make sure that we understand the scope of the issue, and that we fully address your concerns. We consider vulnerability disclosures our highest priority and we will try to address any issue as quickly as possible.

Please be aware that only EU residents can open an account and fully use our services and that we are not currently able to provide researchers with staging or test accounts.

Therefore only EU residents will be able to access the full scope of this program

Disclosure Policy

• Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.

• Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own.

Exclusions

While researching, we'd like to ask you to refrain from:

• Denial of service

• Spamming

• Social engineering (including phishing) of Nuri GmbH staff or contractors, or customers

• Any physical attempts against Nuri GmbH property or data centers

• Any interaction or unauthorized access to data

• Missing best practices (we require evidence of a security vulnerability).

• Use of a known-vulnerable library (without evidence of exploitability).

Out of Scope

• Reports from automated tools or scans.

• Missing cookie flags on non-sensitive cookies.

• Reports of insecure SSL/TLS ciphers (unless you have a working proof of concept, and not just a report from a scanner).

• Exposure of non-sensitive data on mobile devices

• Missing security headers which do not lead directly to a vulnerability, including CSP.

• Our policies on presence/absence of SPF/DMARC/DKIM records.

Third-party bugs

If issues reported to our program affect a third-party library, external project, or another vendor, we reserve the right to forward details of the issue to that party without further discussion with the researcher. We will do our best to coordinate and communicate with researchers through this process, and we will not share your name with third parties without your approval.

Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.

Difference between Nuri and Bitwala

Bitwala rebranded to Nuri in May 2021. Hence, we updated our Hackerone page to reflect the same as well. We updated the scopes to reflect the rebranding to Nuri.

Thank you for helping keep Nuri GmbH and our users safe!