Last updated: 13 October 2026. If you find a security weakness in our Site or platform, report it to security@bstech.world. Good-faith research that follows this policy is welcome.
1. In scope. bstech.world and its subdomains, our public APIs and the developer sandbox. Client production environments are out of scope unless the client has authorised testing in writing.
2. How to report. Email security@bstech.world with a description of the issue, steps to reproduce, affected URLs or endpoints, and your contact details.
3. Our commitments.
- Acknowledge your report within 2 business days.
- Give an initial assessment within 5 business days.
- Keep you informed and credit you, if you wish, once the issue is fixed.
4. Rules for researchers.
- Do not access, change or delete data that is not yours; stop and report as soon as you see real customer data.
- No denial-of-service, spam, social engineering or physical attacks.
- Do not publicly disclose the issue until we have fixed it or 90 days have passed, whichever is sooner, unless we agree otherwise.
- Comply with all applicable laws.
5. Legal position. If you follow this policy in good faith, BSS Tech World will not start civil action or file a complaint against you for your research. We cannot bind public prosecutors, regulators or third parties, and this policy does not authorise anything that UAE Federal Decree-Law No. 34 of 2021 on Combating Rumours and Cybercrimes or other law prohibits. Testing of client environments always needs that client's written permission.
6. Rewards. We do not currently run a paid bug bounty.