Vulnerability Disclosure

1. Our commitment

PulsePanels is committed to keeping our platform, player applications and customers' screens secure. We recognise that no software is perfect and that independent security researchers play an important role in helping us find and fix issues before they can be exploited.

If you believe you have found a security vulnerability in one of our systems, we want to hear from you. We commit to working with researchers who report issues responsibly, and to handling every report in good faith.

2. Scope

In scope

The following PulsePanels-operated assets are in scope for this policy:

• The PulsePanels cloud platform and web applications (the signage management console and its APIs).
• Official PulsePanels player applications distributed by us for supported platforms (for example Android, Windows, Tizen and webOS players).
• This marketing and Trust Center website.

Out of scope

The following are generally out of scope. Reports limited to these categories may be closed without action:

• Third-party services, platforms or integrations that we do not operate (report those to the relevant vendor).
• Social engineering, phishing, or attacks that target our staff, contractors or customers rather than our systems.
• Physical attacks against our offices, hardware, data centres or personnel.
• Denial-of-service (DoS/DDoS), volumetric, or resource-exhaustion testing of any kind.
• Automated scanner output submitted without a demonstrated, exploitable impact.
• Reports of missing best-practice hardening (for example missing security headers or weak TLS ciphers) without a concrete, demonstrated vulnerability.
• Vulnerabilities affecting only unsupported, end-of-life or heavily outdated player versions or browsers.

3. How to report

Please send security reports by email to our security contact: security@pulsepanels.com. If you cannot reach that address, contact our support team at support@pulsepanels.com and ask for your message to be routed to the security team.

A security.txt file is published at /.well-known/security.txt, listing our security contact and a link to this policy.

4. What to include in a report

To help us triage and reproduce the issue quickly, please include as much of the following as you can:

• A clear description of the vulnerability and the security impact you believe it has.
• Step-by-step instructions to reproduce the issue, including any required preconditions.
• The affected URL, API endpoint, application and version, or component.
• Proof-of-concept material (requests, responses, screenshots or a short video) that demonstrates the issue without causing harm.
• Any accounts, tokens or test data you used, so we can trace and clean up test activity.
• Your name or handle for acknowledgement, and how you would like to be contacted.

5. What you can expect from us

When you submit a report in line with this policy, we commit to the following:

• Acknowledge receipt of your report within 3 business days.
• Investigate and validate the report, and work to determine severity and an appropriate fix.
• Keep you informed of our progress, with an update at least every 14 days until the issue is resolved.
• Aim to fix confirmed critical vulnerabilities within 30 days of validating them; less severe issues are scheduled according to their risk.
• Notify you when the issue has been resolved, where appropriate.

6. Safe harbour

We will not pursue or support legal action against you for security research and vulnerability disclosure carried out in good faith, provided you make a genuine effort to comply with this policy and the researcher guidelines below.

Good-faith research means, among other things, that you avoid privacy violations, do not access, modify, delete or exfiltrate data that does not belong to you, do not degrade or disrupt our services, and do not exploit an issue beyond the minimum needed to prove it exists.

7. Researcher guidelines

To keep your research within this policy, please follow these guidelines:

• Do not access, modify or destroy data belonging to other users, customers or the company.
• Stop testing as soon as you have obtained enough evidence to demonstrate the vulnerability, and report it — do not continue to probe or pivot.
• Use only your own test accounts and data where possible, and do not interact with real customer screens or content.
• Do not perform denial-of-service, volumetric or automated high-volume testing.
• Do not publicly disclose the vulnerability until we have confirmed it is fixed or we have agreed a coordinated disclosure timeline with you.
• Comply with all applicable laws throughout your research.

8. Recognition and rewards

We are grateful to researchers who help us keep PulsePanels secure and, where appropriate and with your consent, we may acknowledge your contribution.

We do not run a bug-bounty programme and do not offer monetary rewards for reports. Please do not submit reports on the expectation of payment.

9. Contact

Security reports and questions about this policy can be sent to our security contact, security@pulsepanels.com. General queries can be directed to support@pulsepanels.com.