Vulnerability Disclosure Policy

Ustawi ("Ustawi") welcomes reports from security researchers who discover a vulnerability in our platform, and commits to working with good-faith researchers under the terms below.

In scope: the Ustawi marketing website (ustawi.co.tz), the customer portal, the /api/v1 API, and the mobile field-agent application. Out of scope: third-party services we integrate with but do not operate (e.g. a mobile money provider's own infrastructure), social engineering or phishing of Ustawi staff or tenant users, physical security of our offices or tenant premises, and denial-of-service testing against production tenant environments.

Send a report to security@ustawi.co.tz including: a description of the vulnerability and its potential impact; steps to reproduce (proof-of-concept where possible); and the URL/endpoint or app version affected. Do not include actual borrower or tenant personal data in your report — describe the finding without exfiltrating real records.

Do not access, modify, or exfiltrate another tenant's data beyond what is strictly necessary to demonstrate the vulnerability (given per-tenant data isolation, cross-tenant access itself is often the vulnerability being reported — document it, don't exploit it further). Do not run automated scanning that could degrade Service performance for live tenants. Do not publicly disclose a vulnerability before we've had a reasonable opportunity to remediate it (see Section 5).

Ustawi will not pursue legal action against a researcher who: makes a good-faith effort to comply with this policy; reports a vulnerability promptly and does not exploit it beyond what's needed to demonstrate it; and does not access, modify, or share data belonging to Ustawi or its tenants beyond what's needed for the report. This safe harbor is a good-faith commitment and does not waive any right where a researcher acts in bad faith or causes harm; it is subject to final confirmation by legal counsel.

Ustawi does not currently operate a paid bug-bounty programme. With a researcher's permission, we are happy to publicly acknowledge those who report valid vulnerabilities in good faith. This may change as the programme matures.

This policy does not grant permission to violate any law, or the Acceptable Use Policy (/legal/acceptable-use-policy), beyond what is expressly necessary to responsibly demonstrate a vulnerability in good faith.