Política de divulgação de vulnerabilidades

Security and transparency

Our commitment

We consider the security of our customers to be one of our main priorities. Despite our efforts to implement the best possible security measures, vulnerabilities may still exist in our products, services and systems.

This document describes Mutuo's policy for receiving reports on potential security vulnerabilities in its products and services.

Everyone is encouraged to report identified vulnerabilities, regardless of the type of service or product.

How to report a potential security flaw

For any vulnerability report, please contact us by email at: Mutuo@ued-portugal.pt.

Please include as much information as possible. Do not include personal data in your reports beyond what is necessary to contact you.

Reports are processed solely for the purpose of reporting security vulnerabilities in our services.

Processing your report

After your report, our teams will analyse its content to validate the vulnerability qualification as quickly as possible. Mutuo will then engage in a dialogue to discuss the identified issues.

No remuneration is provided under this programme, even if the vulnerability is confirmed. For security reasons, no publication of flaws or their resolution will be made.

Mutuo remains the sole judge of vulnerability classification and resulting risk categorisation.

Disclosure requirements

• Comply with applicable laws;
• Do not perform denial-of-service or resource exhaustion attacks;
• Use Mutuo systems without intent to harm the company, its customers, employees or third parties;
• Do not use, disclose, modify or delete data accessed by exploiting the vulnerability;
• Do not perform social engineering, spam or phishing attacks against Mutuo employees, third parties or customers;
• Do not test the physical security of Mutuo, third-party or customer property;
• Do not disclose information relating to this policy, the reported vulnerability, or the fact that a vulnerability was reported to Mutuo.

Mutuo commits not to pursue legal action against reporters who submit reports complying with these rules.