Security and vulnerabilities

If you find a vulnerability in Basalt PMS, email support@basaltpms.com with the subject “Security”. Describe what you found and where, how to reproduce it and the impact you see. We will acknowledge receipt within 72 hours. The contact is also listed in security.txt.

In scope: the Basalt PMS web application, the client portal, public pages and the API on basaltpms.com and its subdomains. Out of scope: third-party services (Yandex, Timeweb, Beget, YooKassa, Robokassa, Telegram), denial-of-service attacks, social engineering and phishing of staff and users, spam, physical access.

Do not access other people's data beyond what is needed to confirm the issue, do not modify or delete data, do not disrupt the service, and use only your own test accounts. If you accidentally gain access to someone else's data, stop testing and tell us. Do not disclose the vulnerability publicly until it is fixed or 90 days after we acknowledge it, whichever comes first.

We acknowledge the report within 72 hours, assess it, keep you informed about the fix and, if you wish, credit you. We will not initiate legal action over good-faith research within these rules. No monetary reward is offered.

If you believe your data is affected, write to the same address. For incidents involving personal data we act within the procedure and deadlines of Article 21 of Federal Law No. 152-FZ, and for data we process on your instruction we notify you no later than 72 hours after discovery.