Responsible Disclosure Programme

Responsible Disclosure Programme	Version 1.0
Owner	Chief Information Security Officer
Date last reviewed	08/06/2026

Our Commitment

At Allica Bank, we take the security of our systems, customers, and data seriously.

We recognise and appreciate the role that security researchers play in identifying vulnerabilities and improving security across the internet. Our Security Team works collaboratively with researchers to investigate and remediate reported issues in a timely and responsible manner.

If you believe you have identified a security vulnerability in any of our systems or applications, we encourage you to report it to us.

When to Report

If you identify a potential vulnerability affecting Allica Bank systems, services, applications, or customers, please report it to us as soon as possible.

Scope

This policy applies to:

Public-facing systems and services owned or operated by Allica Bank
Domains and subdomains belonging to Allica Bank.

Out of scope:

Missing Security Headers
Version/Banner Disclosures
Findings that do not demonstrate a clear, reproducible security impact or rely on unrealistic or unsupported assumptions, for example:
- Clickjacking on pages with no sensitive actions
- Self-XSS or user-controlled input that only affects user reporting
- Issues that rely on unrealistic user interaction
Third-party systems not owned or controlled by Allica Bank
Denial of Service (DoS/DDoS) testing
Social engineering, phishing, or physical attacks against staff or customers

If you are unsure whether a system is in scope, please contact us before proceeding.

Safe Harbour

Allica Bank will not seek prosecution or legal action against researchers who:

Act in good faith
Comply with this policy
Avoid causing harm to systems, services, or data
Do not access or exfiltrate data beyond what is necessary to demonstrate the vulnerability

This safe harbour applies within the boundaries of applicable law, including the Computer Misuse Act 1990.

Guidelines for Testing

You may:

Conduct reasonable and proportionate security testing
Use automated tools where this does not negatively impact system availability or performance
Identify and report vulnerabilities, including misconfigurations and exposed assets

You must not:

Attempt to gain access to another user’s account or data
Exfiltrate customer or sensitive internal data unless explicitly agreed in advance
Modify system data or configurations
Perform testing that could degrade service availability or integrity
Conduct social engineering, phishing, or physical attacks

Testing should be limited to the minimum required to demonstrate the issue. In most cases, 2–3 examples are sufficient.

If validation requires more intrusive testing, please contact us in advance.

Handling of Sensitive Information

If you encounter sensitive information (e.g. API keys, credentials, personal data):

Do not validate, exploit, or share the data
Do not retain copies longer than necessary to report
Provide sufficient detail to allow us to investigate

We may request confirmation that any such data has been securely deleted following acknowledgement.

Reporting a Vulnerability

To help us investigate effectively, please include:

A clear description of the vulnerability
The affected system, endpoint, or asset
Steps to reproduce
The potential impact
Supporting evidence (e.g. screenshots or proof of concept where appropriate)

Reports that are low quality, lack reproducibility, or do not demonstrate a security impact may not be prioritised. If your report contains sensitive information, please use our PGP key.

Reports should be sent to: disclosure@allica.bank

Response and Triage

We aim to:

Acknowledge receipt within 5 working days
Triage and validate within 10 working days

If we are unable to meet these timelines, we will provide an update. Lack of response does not grant permission to exploit or publicly disclose vulnerabilities.

Disclosure

We support coordinated vulnerability disclosure.

Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to investigate and remediate
We will work with you to agree an appropriate disclosure timeline
Where appropriate, we are happy to acknowledge researchers for their contribution
All communications should go to disclosure@allica.bank

Publicly Exposed Credentials

If you discover exposed credentials (e.g. API keys, passwords):

Do not attempt to validate or use them
Report them to us with details of where and how they were discovered
Use PGP encryption where sensitive data is included

Legal

This policy does not authorise any activity that would violate applicable laws or regulations, including:

Computer Misuse Act 1990
UK GDPR and Data Protection Act 2018

Additional Notes

We may request further information or clarification, including proof-of-concept evidence where required.
Do not contact other parts of the organisation (e.g. support channels, employees, or social media) regarding vulnerabilities, all communication should go through disclosure@allica.bank

PGP Key