Vulnerability Disclosure & Security Reporting Policy

How to report: send a report to security@syibe.com. Please include what you found, where you found it, the steps needed to reproduce it, the potential impact as you see it, and how you would like to be credited. Reports may be submitted in Arabic or English, and anonymously.

What SYIBE undertakes: to acknowledge a report within three business days, to assess it and tell the reporter whether it is accepted, to keep the reporter informed of progress at reasonable intervals, to fix confirmed issues on a timeline set by severity, and to confirm when a fix is in place. [COMMERCIAL DECISION REQUIRED] on final response and remediation targets.

Safe harbour: where a reporter acts in good faith and within this policy, SYIBE will treat the research as authorised, will not pursue or support legal action against them for that research, and will say so if a third party raises the matter. This assurance is given by SYIBE only; it cannot limit the rights of any other party or any authority, and it does not apply to activity outside this policy.

In scope: the SYIBE rider application, the public website, publicly reachable interfaces of the SYIBE platform, and physical security or tamper issues observed on a SYIBE vehicle in the street.

Out of scope and never permitted: accessing, downloading, modifying or deleting data that is not your own; degrading or denying service, including load, stress or volumetric testing; social engineering, phishing or physical intrusion against SYIBE staff, contractors, riders or premises; taking, immobilising, dismantling or riding a vehicle without paying in order to test it; brute-force or credential-stuffing attacks; and testing systems belonging to SYIBE's providers rather than SYIBE.

Handling personal data found during research: stop, do not copy or retain it, and tell SYIBE what you saw and how you reached it. Retaining, publishing or sharing another person's data takes the research outside this policy.

Coordinated disclosure: please give SYIBE a reasonable period to fix a confirmed issue before publishing anything about it. SYIBE will agree a disclosure date with the reporter, does not require indefinite silence, and will not use this policy to suppress publication after a fix or after a reasonable period has passed. [COMMERCIAL DECISION REQUIRED] on the standard period.

No public detail of internal security architecture: this policy intentionally does not describe SYIBE's internal systems, network design, security controls, monitoring, key management, provider configuration or vehicle firmware protections. Technical detail is exchanged privately with the reporter only to the extent needed to reproduce and fix the issue.

Recognition: SYIBE maintains a thanks list for reporters who wish to be named. There is no bounty programme at this stage; whether one is introduced is a later decision and this policy will be versioned if it changes. [COMMERCIAL DECISION REQUIRED]

Riders and members of the public who suspect their own account has been compromised should use the support channel in the application rather than this route; account-security incidents are handled under the Privacy Policy and the Terms of Service.

Internal handling: every report is logged in an internal security register with severity, affected component, decision and remediation date; the register is not public. Where an incident affects personal data, the breach-notification duties in the Privacy Policy apply.