1. Scope

This policy covers:

• all 365 business apps for Microsoft Dynamics 365 Business Central,
• the 365 business API and our other cloud services,
• this website.

Out of scope:

• Microsoft Dynamics 365 Business Central itself and other Microsoft services. Please report these to the Microsoft Security Response Center (MSRC).
• denial-of-service testing,
• social engineering,
• physical attacks.

2. How to report

Send your report by email to security@365businessdev.com. Please include:

• the affected product and version,
• a description of the vulnerability,
• steps to reproduce it,
• its possible impact,
• contact details for follow-up questions.

Please do not include personal data of third parties.

3. Our commitments

• Acknowledgement of receipt within 3 business days.
• Initial assessment within 10 business days.
• Critical vulnerabilities are usually fixed within 14 days, high-severity vulnerabilities within 30 days.
• We keep you informed of progress and, if you wish, credit you in the security advisory.

4. Rules for reporters

• Only test as far as necessary to demonstrate the vulnerability.
• Do not access or modify data of other customers.
• Only publish the vulnerability after it has been fixed or after 90 days, in agreement with us.

5. No rewards

We do not run a bug bounty programme.

6. Security advisories

No advisories so far.