Vulnerability Disclosure Policy

Content Ignite Limited ("Content Ignite", "we") takes the security of our platform and the publishers who rely on it seriously. If you believe you have found a security vulnerability in any of our systems, we want to hear from you. This policy explains what is in scope, how to report an issue, what you can expect from us, and the rules we ask you to follow.

Scope

This policy covers systems that Content Ignite owns and operates:

the Content Ignite platform (Fusion), including white-label instances of it that we host for our clients
our APIs, including api.tagdeliver.com
our publisher tag and the services it calls, including cdn.tagdeliver.com, uc.tagdeliver.com, log.tagdeliver.com and pbs.tagdeliver.com
our mobile advertising SDK
contentignite.com, tagdeliver.com and their subdomains

The following are out of scope:

services we use but don't operate, such as Google Ad Manager, consent management platforms, demand partners, and our hosting and CDN providers; please report issues in those to the provider directly
publishers' own websites and apps, except where the issue is caused by our tag or SDK
systems operated by our white-label clients themselves

How to report a vulnerability

Email security@contentignite.com. Please include:

the system, URL or component affected
a description of the vulnerability and its potential impact
step-by-step instructions to reproduce it, including any proof-of-concept code, screenshots or requests
your name or handle, if you'd like to be credited

If you're not sure whether something is a security issue, report it anyway. We would rather hear about it.

What you can expect from us

When you report a vulnerability in good faith, we will:

acknowledge your report within 3 business days
give you an initial assessment within 10 business days, including whether we can reproduce it and how serious we think it is
keep you informed as we work on a fix
fix confirmed issues according to their severity, with critical issues treated as our highest priority
let you know when the issue is resolved
credit you publicly for the discovery, if you'd like us to

Rules for testing

To protect our clients, publishers and the people who visit their sites, please:

only test against accounts you own, or accounts you have explicit permission to use
only access the minimum data needed to demonstrate the vulnerability; if you come across personal data or another client's data, stop, don't copy or keep it, and tell us in your report
not modify, delete or corrupt data, or change any configuration you don't own
not degrade our services or anyone else's; this includes denial-of-service testing and high-volume automated scanning
not generate fake ad impressions, clicks or bid requests, or do anything else that would affect advertising delivery, reporting or billing
not test on publishers' live websites in a way that affects real visitors
not use social engineering, phishing or physical attacks against our staff, offices or clients
keep details of the vulnerability confidential until we have fixed it, as described under Coordinated disclosure

Issues we don't treat as vulnerabilities

Unless you can show a real security impact, we don't treat the following as vulnerabilities:

missing security headers or best-practice settings with no demonstrated exploit
clickjacking on pages with no sensitive actions
reports of software versions without a working exploit
self-XSS, or issues that need a victim to paste code into their own browser
missing rate limiting with no meaningful impact
email configuration findings such as SPF, DKIM or DMARC records
the output of automated scanners without manual verification

Safe harbour

If you make a good-faith effort to follow this policy, we will consider your research authorised. We will not pursue legal action against you or report your research to law enforcement, and we will work with you to understand and resolve the issue. If a third party takes legal action against you for research that followed this policy, we will make it known that your work was authorised by us.

This does not authorise testing of any third-party systems, which remain subject to their owners' policies.

Coordinated disclosure

We ask that you give us reasonable time to fix an issue before you share details publicly. Please wait until we confirm a fix is in place, or 90 days from your report, whichever comes first. If an issue needs longer to fix, we will explain why and agree a timeline with you.

Bug bounty

We do not currently run a paid bug bounty programme, and we are not able to offer payment for reports. We are grateful for every report we receive and are happy to credit researchers publicly.

Contact

Security reports: security@contentignite.com

This policy is also referenced from our security.txt file at https://www.contentignite.com/.well-known/security.txt.