Nift Vulnerability Disclosure

generated: '2026-08-13'
method: searched
source: https://www.gonift.com/business/vulnerability-disclosure-policy
program:
  published: true
  name: Nift Networks Vulnerability Disclosure Policy
  url: https://www.gonift.com/business/vulnerability-disclosure-policy
  http_status: 200
  type: vulnerability-disclosure-policy
  bug_bounty: false
  bounty_platform: null
  paid_rewards: false
contact:
  email: security@gonift.com
  method: email
  security_txt: false
  security_txt_note: >-
    No RFC 9116 /.well-known/security.txt is served — /.well-known/security.txt and
    /security.txt both return 404 on www.gonift.com, gonift.com and nift.me. The policy
    is an HTML page only, so an automated scanner will not find it.
scope:
  in_scope: >-
    All websites, applications and services owned or operated by Nift.
  out_of_scope: >-
    Any other systems or services, unless explicitly authorized.
prohibited:
  - Distributed Denial of Service (DDoS) attacks
  - Social engineering (phishing, vishing, etc.)
  - Physical security attacks against Nift offices, employees, or contractors
researcher_guidelines:
  - Respect privacy — avoid accessing, modifying, or deleting user data
  - Do no harm — do not disrupt services, degrade performance, or compromise availability
  - No financial threats — do not attempt to extort or demand payment for disclosures
  - Limit exploitation — only use methods necessary to demonstrate the vulnerability
  - Report promptly
response_process:
  acknowledgement_sla: 5 business days
  steps:
    - Acknowledgment — receipt confirmed within 5 business days
    - Assessment — security team investigates, validates and prioritizes
    - Remediation — fix issued as quickly as possible
  public_acknowledgement: true
  public_acknowledgement_note: Contribution acknowledged publicly with the researcher's consent.
safe_harbor:
  offered: true
  terms:
    - Authorized under the Computer Fraud and Abuse Act (CFAA)
    - Exempt from Nift's terms of service restrictions
    - No legal action from Nift for research performed responsibly
report_should_include:
  - A detailed description of the vulnerability
  - Steps to reproduce the issue
  - The potential impact
  - Any suggested remediation (optional)
notes: >-
  A real, substantive VDP with named safe-harbor terms, a stated acknowledgement SLA and a
  dedicated security@ mailbox — stronger than most companies of Nift's size. The gap is
  discoverability: it is linked only from the site footer under "Terms & Policies" and is not
  mirrored to /.well-known/security.txt, so neither the automated probe in
  well-known/nift-well-known.yml nor probe-security-programs.py found it. Publishing a
  security.txt pointing at this page would close that gap.