Vulnerability Reporting Policy

We take the security of our systems, applications, and customer data seriously. To continuously improve the level of protection, we welcome reports of vulnerabilities from researchers acting in good faith. This document defines the scope, interaction rules, and expectations for responsible disclosure. Scope of action

Part of the region:

• Domain *.bankffin.kz.(all subdomains, unless otherwise specified)
• Domain *.freedombank.kz
• Mobile App Freedom SuperApp on the App Store (iOS)
• Mobile App Freedom Business on the App Store (iOS)
• Mobile App Google Play Apps-Freedom SuperApp (Android)
• Mobile App Google Play Apps – Freedom Business (Android)

Not included in the scope of:

• Third-party services and contractors that do not belong to Freedom Bank Kazakhstan JSC;
• Social engineering, phishing, and physical security testing.
• DoS / DDoS attacks, spam, and flooding.
• Vulnerabilities that require stolen or compromised credentials.

If you find a problem outside the specified area, but related to Freedom Bank Kazakhstan JSC, please let us know — we will consider it separately.

Interaction rules

• Do your testing in a way that doesn't disrupt the services or affect your customers.
• Use only unauthenticated testing.
• Automated scanning should be limited in frequency so as not to overload the systems.
• Do not perform post-exploitation (for example, accessing customer data, changing information).
• If you accidentally gain access to sensitive data (personal data, financial information, etc.), stop testing and report it immediately.
• It is forbidden to use the found vulnerabilities for personal gain, fraud, or extortion.

Message rules

The vulnerability report should be sent to the following email address: [email protected]
To increase your privacy, please encrypt your message with a PGP key: PGP key Freedom Bank Kazakhstan

To speed up verification and correction, specify in the report:

• The system, application, or endpoint where the vulnerability was detected.
• Type and description of the vulnerability.
• Steps to reproduce (PoC);
• Potential impact;
• Possible correction recommendations (if any).

Vulnerability assessment

We use CVSS to classify the severity of:

• Critical (CVSS 9.0-10.0).
• High (CVSS 7.0-8.9);
• Average (CVSS 4.0–6.9).
• Low (CVSS 0.1–3.9).
• Informationalinformation.

In some cases, the priority may be adjusted to reflect the business context or the likelihood of exploitation.

Guarantees for researchers (Safe Harbor)

If the research is conducted within the framework of this policy:

• If you comply with the terms of this policy by informing us about a potential security issue, we consider it resolved and will not file a complaint with law enforcement agencies or initiate a civil claim in case of fair testing.
• Actions carried out in accordance with this policy, as well as if they do not contradict the requirements of the legislation of the Republic of Kazakhstan, the Law of the Republic of Kazakhstan "On Copyright and Related Rights" and the criminal legislation of the Republic of Kazakhstan are permitted behavior.

The researcher must comply with the current legislation of the Republic of Kazakhstan and act in good faith.

Confidentiality and disclosure

• All reports are treated as confidential.
• Publication of information about the vulnerability is possible only after its correction and written permission of Freedom Bank Kazakhstan JSC.
• We are committed to quickly confirm receipt of the report and work on fixing the problem in a timely manner.