Responsible Disclosure

What is Responsible Disclosure?

Responsible Disclosure is a method to report system vulnerabilities which allows the recipient sufficient time to identify and apply the necessary countermeasures before making the information public.

By following this controlled and ethically correct model of reporting, the sender helps companies to identify and resolve system flaws, thus providing a valuable and efficient contribution to increase the security of ICT services and avoiding damage or disruption to the systems involved.

Our Commitment

At CaratStone, we are committed to working with security researchers to protect our users and the broader jewellery ecosystem. We appreciate responsible disclosure and promise to:

• Acknowledge your report within 48 hours
• Provide transparent communication throughout the resolution process
• Work diligently to verify and resolve legitimate issues
• Give credit to researchers who help improve our security (with permission)
• Not take legal action against researchers who act in good faith

Reporting Guidelines

When submitting a vulnerability report, please include:

• Detailed description of the vulnerability
• Steps to reproduce the issue
• Potential impact and severity assessment
• Any proof-of-concept code or screenshots
• Your contact information for follow-up

Please do not: Publicly disclose the vulnerability before we've had a chance to address it, access or modify user data, or perform actions that could harm our services or users.