Vulnerability Disclosure Policy

We want to hear about security weaknesses in our services before anyone else exploits them. This policy explains how to report a vulnerability, what we will do, and the legal protection we give to researchers acting in good faith.

---

1. Scope

In scope:

• *.scolah.com web applications and APIs operated by Scolah, Inc., including the Scolah Compass Platform portal and API
• The Scolah agent, the Scolah Kubernetes operator, and their Helm charts
• Scolah’s own container images, and the bundle signing and verification process
• The Scolah, Scolah Compass and Scolah Care mobile apps

Out of scope:

• Servers, clusters and networks owned by our customers. Do not test a customer’s installation without that customer’s written permission.
• Vulnerabilities in third-party open-source applications delivered through the Platform catalog (for example Metabase, Keycloak or DHIS2). Please report those to the upstream project. Tell us as well if the issue is made worse by how we package or configure the software.
• Denial-of-service testing, volumetric attacks, or anything that degrades service for others
• Social engineering, phishing, or physical attacks on Scolah staff, offices or customers
• Findings with no demonstrated security impact, such as missing headers on static pages, self-XSS, clickjacking on pages without sensitive actions, or software version disclosure

2. How to Report

Email security@scolah.com with:

• A description of the vulnerability and its impact
• The steps to reproduce it, including affected URLs, versions, or components
• Any proof-of-concept code or screenshots
• How you would like to be credited, if at all

If your report contains sensitive detail, ask in your first email for an encrypted channel and we will set one up.

3. Our Commitments

Step	Target
Acknowledge your report	Within 3 business days
Initial assessment and severity	Within 10 business days
Status updates	At least every 14 days until resolved
Fix for critical issues	Aimed at within 30 days
Public disclosure	Coordinated with you, normally within 90 days of your report

If a fix requires customers to upgrade software on their own servers, we will publish a new signed bundle or agent release and notify affected customers before disclosure.

4. Safe Harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised. We will not bring legal action or report you to law enforcement for it, and we will not pursue claims under anti-hacking or anti-circumvention laws.

To stay within safe harbour you must:

• Access only the data you need to show the vulnerability, and stop as soon as you encounter personal data. Do not copy, keep or disclose it.
• Use only test accounts you own, or accounts whose holders have explicitly agreed
• Not modify or delete data, or interrupt the service
• Give us reasonable time to fix the issue before telling anyone else
• Not demand payment or other benefit in exchange for withholding or delaying disclosure

If a third party brings legal action against you for activity that complied with this policy, we will make it known that your actions were authorised.

5. Recognition

We do not run a paid bug bounty. With your permission, we will thank you by name on this page once the issue is fixed.

Thanks

No reports have been credited yet.