Reporting a Security Vulnerability

Security Vulnerability Information

At Adevinta Real Estate, protecting our customers' data is extremely important to us. We greatly value the role security researchers play in helping keep our systems and information secure. To encourage responsible vulnerability disclosure, Adevinta Real Estate's security team is committed to working closely with the research community. We will carefully investigate all legitimate vulnerability reports, recreate any confirmed issues, and work quickly to properly address them.

If you discover a potential security vulnerability in any Adevinta Real Estate products or services, please report it to us right away. We will look into every credible report received and do our best to quickly resolve any validated vulnerabilities.

We ask that you do not publicly disclose your findings until we've had a chance to review and address the reported issues with you first. While we will consider reasonable public disclosure requests, Adevinta Real Estate reserves the right to deny them. Your help in maintaining Adevinta Real Estate's security is truly appreciated.

Responsible Disclosure Guidelines

To encourage responsible disclosure, Adevinta Real Estate will not initiate legal action against security researchers for assessing vulnerabilities as long as they adhere to this policy, including:

• Notify Adevinta Real Estate and provide all details through the HackerOne Vulnerability Disclosure Program form below.
• Only test accounts you own or have explicit permission for
• Do not access, modify or delete data that does not belong to you
• Do not engage with other users or employees, any action must be taken within test accounts under your control.
• Do not exploit vulnerabilities beyond what is needed to identify and report them
• Do not conduct denial of service, phishing, social engineering or physical attacks
• Do not conduct any testing on physical security of Adevinta Real Estate premises, personnel, equipment, etc.
• Do not test third-party services that integrate with Adevinta Real Estate
• Do not violate laws or disrupt services
• In submitting a security vulnerability report, you grant Adevinta Real Estate permission to utilise the information contained in your report as we deem appropriate.

Public Acknowledgments Policy

Currently, Adevinta Real Estate does NOT publicly disclose or maintain a list of security vulnerabilities reported by external parties or the individuals who reported them.

Privacy

For information on how Adevinta Real Estate processes and safeguards personal data, please refer to our Privacy Policy available here.

Policy Changes

Adevinta Real Estate reserves the right to terminate or modify this vulnerability disclosure program and policy at any time. Before conducting any security testing or taking actions based on this policy, please review the latest version here.