Reporting a Vulnerability
We welcome reports of vulnerabilities in our website and services. Machine-readable details, including where to report and how long this policy is valid, are published in our security.txt in line with RFC 9116.
Please send reports to security@arterect.co.jp, in Japanese or English. Steps to reproduce, the scope of impact, and screenshots where useful will help us investigate quickly.
security.txt (RFC 9116)A machine-readable file listing where to report vulnerabilities, when the details expire and where our policy lives.arterect.co.jp/.well-known/security.txtIn scope
- Authentication and authorisation flaws (bypassing access control, privilege escalation)
- Execution-class vulnerabilities such as arbitrary code execution, cross-site scripting (XSS) and SQL injection
- Exposure of personal data, credentials or non-public information
- Vulnerabilities arising from server or network misconfiguration
Out of scope
- Scanner output alone, with no steps to reproduce
- Denial of service, load testing, or any test involving a large volume of requests
- Social engineering, physical intrusion, or any approach involving contact with our staff
- Vulnerabilities in third-party services we use (please report those to the provider)
- Deviations from best practice with no explanation of actual impact
While you are testing
- Keep testing to the minimum necessary, and do not obtain, alter or delete anyone else's data.
- If you reach personal data, stop immediately and report it without retaining what you obtained.
- Please do not disclose the vulnerability to anyone else until it has been fixed.
What to expect from us
- We will send a first reply within three business days of receiving your report.
- We will keep you updated on the investigation and on when we expect to have a fix.
- After the fix, we will credit you if you would like us to. We do not currently run a paid bug bounty.
We will not take legal action against anyone who investigates and reports in good faith in line with this policy.
This English text is provided for convenience. The Japanese version is the authoritative text; if the two differ, the Japanese version prevails.