Сигурност на сайта
Responsible security disclosure
At Jetnify, protecting our customers, booking systems,
payment processes and website infrastructure is important to us.
We appreciate the work of independent security researchers and members
of the security community who responsibly identify and report potential
vulnerabilities.
Reporting a security vulnerability
If you believe you have discovered a security issue affecting
Jetnify.com or one of our services, we encourage you
to report it privately so that we can investigate and address it.
Please report genuine security vulnerabilities using the security
contact published in our security.txt file.
https://www.jetnify.com/.well-known/security.txt
What to include in your report
Please provide enough information for us to understand and reproduce
the issue, including where possible:
- the affected URL, page, endpoint or service;
- a clear description of the vulnerability;
- the steps required to reproduce it;
- the potential security impact;
- screenshots or supporting technical information;
- the browser, operating system or environment used; and
- your contact information if you would like us to respond.
Please submit one clearly described vulnerability per report unless
several issues are directly related.
Responsible testing guidelines
We welcome responsible security research, but testing must not cause
harm to Jetnify, our customers, suppliers or other parties.
When researching a potential vulnerability
- use the minimum testing necessary to demonstrate the issue;
- avoid disrupting Jetnify services;
- stop testing once you have sufficient evidence of a vulnerability;
- only access accounts and data that belong to you or for which you have explicit permission;
- protect any information accidentally obtained during research; and
- report the vulnerability privately before discussing it publicly.
Please do not
Security research must not include:
- denial-of-service or distributed denial-of-service attacks;
- deliberately excessive automated traffic;
- destruction, deletion or modification of data;
- accessing another customer’s booking or personal information;
- downloading or retaining personal information that does not belong to you;
- social engineering of Jetnify staff, customers, suppliers or partners;
- phishing;
- physical attacks against our offices, infrastructure or employees;
- installation of malware;
- attempts to compromise third-party airlines, payment providers, booking platforms or suppliers through Jetnify;
- fraudulent bookings or payment transactions;
- intentional disruption of airline reservation or ticketing systems; or
- public disclosure of an unresolved vulnerability before we have had a reasonable opportunity to investigate it.
Given that Jetnify operates travel search and booking services that
depend on external reservation infrastructure, availability testing
that could interfere with legitimate bookings is particularly prohibited.
Third-party systems
Jetnify uses and integrates technology supplied by third parties,
which may include:
- airlines;
- global distribution systems;
- NDC providers;
- travel aggregators;
- reservation platforms;
- payment processors;
- hosting and infrastructure providers; and
- other travel technology services.
Please report vulnerabilities in Jetnify-controlled systems to us.
If a vulnerability exists exclusively within a third-party service
and does not result from Jetnify’s implementation or configuration,
it may need to be reported directly to the relevant provider.
Please do not attempt to expand testing into third-party infrastructure
without that provider’s authorization.
Customer and booking data
Customer privacy is especially important.
If you accidentally encounter:
- personal information;
- passenger information;
- booking records;
- payment-related information;
- authentication credentials; or
- other confidential information,
please stop testing immediately and notify us.
Do not copy, download, share, alter, delete or retain such information
beyond what is strictly necessary to identify the security issue.
Any sensitive information included in a security report should be minimized.
Payment security
Do not use real stolen, unauthorized or compromised payment information
for security testing.
Testing must never involve transactions using financial credentials
that you are not authorized to use.
Potential vulnerabilities concerning Jetnify’s payment flow should be
reported through our security contact without conducting unauthorized transactions.
Vulnerability rewards
Recognition may be considered for valuable reports
Jetnify may, at its discretion, recognize particularly valuable
reports concerning serious vulnerabilities that are reported
responsibly and for the first time.
Any recognition or reward is entirely discretionary unless Jetnify
separately publishes a formal bug-bounty program with defined
eligibility rules and rewards.
Submitting a report does not automatically create an entitlement
to payment or compensation.
What makes a useful security report?
Reports are especially useful when they demonstrate a meaningful
security impact.
Access and identity
Authentication or authorization issues, unauthorized access,
account security and privilege escalation.
Customer information
Unauthorized access to customer, passenger or booking information,
or serious sensitive-information disclosure.
Application security
Serious cross-site scripting, SQL or command injection,
server-side request forgery and remote code execution.
Security controls
Payment-related security issues, meaningful security-control
bypasses or other vulnerabilities with demonstrable impact.
Reports concerning ordinary software behavior, configuration
preferences or issues without meaningful security consequences
may not be treated as vulnerabilities.
Response process
When we receive a credible security report, we aim to:
Acknowledge receipt
Review and reproduce the issue
Determine severity and impact
Take reasonable remediation steps
Communicate where further information is required
Complex issues or vulnerabilities involving external technology
providers may take longer to investigate or resolve.
We ask researchers to allow us a reasonable period to investigate
and correct a vulnerability before considering public disclosure.
Good-faith research
We consider security research to be responsible when it follows
the principles and restrictions described on this page.
Researchers acting in good faith should make reasonable efforts to:
- avoid privacy violations;
- avoid disruption;
- avoid unnecessary access to data;
- report vulnerabilities promptly; and
- cooperate with remediation efforts.
This policy does not authorize activity that is illegal or that
affects systems belonging to third parties.
Reporting fraud or unauthorized card transactions
Security vulnerability reports and fraud reports are different.
If your credit or debit card, bank account or other payment method
has been used without your authorization, contact your
bank or card issuer immediately.
Your financial institution can:
- block or replace the affected payment card;
- investigate unauthorized transactions;
- advise you about chargeback or dispute procedures; and
- take steps to prevent further unauthorized use.
If the transaction relates to a Jetnify booking, you may also
contact Jetnify Customer Support with the relevant booking information.
Do not send complete card numbers, CVV codes,
passwords or other sensitive authentication credentials by ordinary email.
Reporting account misuse
If you believe someone has gained unauthorized access to your
Jetnify account or booking, contact Jetnify Customer Support as
soon as possible.
Where appropriate, change affected passwords and review your email
and financial accounts for suspicious activity.
Security contact
Security matters should be sent only to the dedicated security
contact identified in:
https://www.jetnify.com/.well-known/security.txt
General booking questions, refunds, cancellations and customer-support
requests should be submitted through the normal Jetnify
customer-support channels.
Policy updates
We may update this Site Security and Responsible Disclosure Policy
as Jetnify’s services, infrastructure and security practices evolve.