72 Nation72 NATION
Legal

Responsible Disclosure

Version 1.0Effective 24 August 2026Governed by Israeli law

If you have found a vulnerability in this site or in something we have published, we want to hear from you, and we will not come after you for telling us. This page sets out how to report it and what we commit to in return.

1 · Scope

This policy covers 72nation.com and its subdomains, and any software or artifact we publish under the 72 Nation name. It is also published in machine-readable form at /.well-known/security.txt, in the format set out in RFC 9116.

It does not cover systems belonging to our clients, including deployments we have made into a public authority’s own network. Those are the authority’s systems and are out of scope. If you believe you have found something affecting one of them, report it to us privately and we will route it to the right owner without you testing it further.

2 · How to report

  • Email security@72nation.com.
  • Include what you found, where, and the minimum steps needed to reproduce it. Redact any real personal data.
  • Tell us if you intend to publish, and when. We will work to your timeline where we reasonably can.
  • If you need encryption before sending detail, ask us and we will provide a key.

3 · What we commit to

AcknowledgementWithin 2 working days.
AssessmentAn initial assessment, including our view of severity, within 10 working days.
RemediationCritical issues addressed as a priority; everything else on a timeline we will share with you and keep you updated against.
CreditPublic credit where you want it, and none where you do not.
Safe harborWe will not pursue legal action, or ask anyone else to, in respect of good-faith research that follows this policy. We consider such research authorized under the Israeli Computers Law, 5755-1995 and equivalent law elsewhere. If a third party brings action against you for research conducted within this policy, we will make that authorization known.

4 · Rules for good-faith research

  • Access only data that is your own or that you have created for testing. Stop at the point where you can demonstrate the issue.
  • Do not exfiltrate, retain, or share data belonging to anyone else. Delete anything you obtained incidentally, and tell us you did.
  • Do not degrade our service: no denial of service, no volumetric or brute-force testing, no automated scanning at a rate that affects availability.
  • Do not use social engineering, phishing, or physical intrusion against our people or premises.
  • Do not disclose the issue publicly until we have had a reasonable opportunity to fix it, or 90 days have passed, whichever is first.

5 · Out of scope

The following are generally not accepted as vulnerabilities: missing headers with no demonstrated exploit; results from automated scanners without a working proof of concept; issues requiring an outdated or unpatched browser; the absence of rate limiting on non-authenticated endpoints; theoretical attacks with no practical impact; and reports concerning our email deliverability configuration where no spoofing is demonstrated.

6 · Reward

We do not operate a paid bug bounty. We offer acknowledgement, credit, and a direct line to the people who will fix it. We will say so plainly rather than imply a payment that is not coming.

7 · Our own practice

  • Anything we deploy stays inside the network of the organization that owns it, and that organization retains control and override.
  • Every decision a deployed system takes on someone’s behalf is recorded and reviewable by the organization running it.
  • Access to client environments is limited to named individuals for a stated purpose and a stated period.
  • If an incident affects a client, that client hears it from us first, in writing, with what we know and what we do not.

8 · Contact

security@72nation.com · Effective 24 August 2026.