Responsible Disclosure Policy

If you discover a security vulnerability in our services or websites, we encourage you to report it to us immediately. This page clarifies what is and isn't allowed during security testing.

1 Introduction

If you discover a security vulnerability in our services or websites, we encourage you to report it to us immediately. This page clarifies what is and isn't allowed during security testing.

What We Allow (Allowed)

Discovering vulnerabilities in a way that does not harm the system.
Testing only on public pages.
Testing common vulnerabilities (XSS, CSRF).
Submitting information through official channels.

What We Do Not Allow (Not Allowed)

Conducting DDoS attacks or flooding the server.
Attempting to access customer data.
Testing internal private systems.
Causing service interruption.

4 How to Submit a Report and Communication Channels

The report must include: a brief description, reproduction steps (PoC), and potential impact.

Email: security@reit.sa

5 Mutual Commitments

Our commitment: Not to prosecute good-faith researchers, respond within 3-7 days, and acknowledge efforts (Hall of Fame).
Researcher commitment: Full confidentiality, not exploiting the vulnerability, and immediate reporting.