Vulnerability Disclosure Policy

Applies to: facilityfirst.com

1. Purpose

1.1 Facility First, Inc. (“Facility First”) welcomes reports of suspected security vulnerabilities in the website at facilityfirst.com (the “Website”). This Policy explains how to report a vulnerability and what Facility First asks of anyone who does.

2. How to Report

2.1 Reports should be sent to the security contact listed in the Website’s security.txt file at facilityfirst.com/.well-known/security.txt.

2.2 A report should describe the issue, the page or feature affected, the steps needed to reproduce it, and how the reporter can be contacted.

3. Guidelines for Reporters

3.1 Section 5.2 of the Website Terms and Conditions prohibits probing, scanning or testing the Website. This Policy does not authorize testing. It provides a channel for reporting issues that a person has come across.

3.2 Reporters are asked to:

not access, change or delete data that does not belong to them;
not disrupt the Website or degrade its performance;
not use social engineering, physical intrusion or attacks on Facility First personnel, clients, service providers or vendors;
not publicly disclose the issue until Facility First has had a reasonable time to address it; and
comply with all applicable laws.

4. What Facility First Will Do

4.1 Facility First will make reasonable efforts to acknowledge reports, review them and address confirmed issues. Facility First may contact the reporter for more information.

4.2 Facility First does not offer payment or rewards for reports.

5. Out of Scope

5.1 This Policy covers the Website only. It does not cover third-party services linked from the Website, including the separate application reached through the client and service provider login links, social media and mapping services, which should be reported to their owners.

5.2 This Policy does not cover the condition or physical security of client facilities, or work performed by service providers. Concerns about a facility, a service request or a service provider should be raised through the Contact page.

6. Nature of This Policy

6.1 This Policy is not a contract and does not create any right or authorization to test the Website. Facility First may change it at any time by posting an updated version.