At MrD, we've built our business on the simple principle that our customers come first. We aim to keep our website, mobile site, and related software applications ("Website"), as well as the service offered on our Website ("Service") safe for everyone to use, and data security is of the utmost importance. If you have discovered a security vulnerability in our Website or Service, we encourage you to contact us and disclose it to us in a responsible manner.
When security vulnerabilities are reported to us in compliance with this policy, MrD will validate and fix such vulnerabilities as soon as reasonably possible, in line with our commitment to the privacy, safety and security of our customers. We will not take legal action against you or terminate your access to the Service if you discover and report security vulnerabilities responsibly in compliance with this policy. MrD reserves all of its legal rights in the event of any non-compliance with this policy.
If you are a current customer and observe any unauthorised activity occurring on your account, or suspect that your account might be compromised, please contact us at security@mrd.com so that it can be investigated by the relevant teams. For any other queries, please contact us here. Your issue will be investigated immediately and thoroughly.
Reporting a Security Vulnerability
If you think that you have found a security vulnerability in our Website or Service, please contact us immediately via security@mrd.com. When reporting a security vulnerability, you must do the following:
- Include sufficient information in your report, as we require a way to validate and reproduce the security vulnerability.
- Proof-of-Concept (PoC) scripts or tools are encouraged, and the following information is required:
- The URL or API path/parameter where the vulnerability occurs.
- The type of vulnerability, which should include a clear description of the issue.
- Step-by-step instructions to reproduce the vulnerability.
- If applicable, an attack scenario, as this may help demonstrate the risk and get the issue resolved faster.
- The test account that was used during testing.
- Do not share or discuss your findings with anyone. This includes friends or colleagues. It is also strictly prohibited to post on blogs or social media platforms about your findings.
- Please provide us with your full name.
- Testing must be performed using a test account that is identifiable by MrD and disclosed in your findings.
In-scope Findings
The following types of findings are in-scope and are of interest to MrD, on the mrdfood.com domain and its subdomains:
- Web application attacks after a user is authenticated into their MrD account.
- Administrative panels or open ports or services that are accessible to the public.
- Cross-site scripting, XML External Entity injection and SQL injection attacks.
- Remote code execution.
- Circumventing permission limitations.
- Cross-Site Request Forgery (CSRF) or Server-side Request Forgery (SSRF).
- Privilege escalation.
- Authorisation bypass.
Out-of-scope Restrictions
At MrD, we welcome “white hat” security researchers, and appreciate your research and proactive responsible disclosure. Please note however that MrD does not permit you to do any of the following:
- Access, modify or destroy a MrD customer's account or data. Should you suspect that you are able to view or control a MrD customer's account or data, please reach out to us before attempting such exploits so that MrD will take further steps to resolve this.
- Interrupt or degrade our services.
- Execute a "Denial of Service" attack, which could affect the availability of our services for any period of time.
- Post, transmit, upload, link to, send or store any malicious software onto any of our systems. Should you suspect there is an avenue to obtain access into our internal network, please contact us immediately and MrD will take further steps to resolve this.
- Send any unsolicited or unauthorised mail or messages, this includes attempts to spoof emails, spam or perform phishing attacks.
- Violate any applicable law or act.
- Attempt attacks against third-party pages, including payment pages, or any sellers' websites (where applicable). Attempts can only be made against the mrdfood.com domain and its subdomains.
- You are only allowed to pursue exploiting a vulnerability that contravenes the above-mentioned restrictions further, once the Security team has vetted and given you permission to continue. Should there be any deviations from the agreement with the Security team, this will no longer be regarded as being in accordance with this policy.
Contravening this Policy in any way may result in us suspending or terminating your access to the Website and Service, contacting the relevant authorities and/or pursuing any other remedies we have at law.
Non-qualifying Submissions
The risk and value of a vulnerability is determined by its impact and exploitability. If a vulnerability is not directly exploitable or does not lead to a significant threat, it will not form part of this Policy. The following types of disclosures are not part of this Policy:
- Informative error messages or banner disclosure.
- Expected, known public files or directories, (e.g. robots.txt).
- Clickjacking or CSRF on pages without sensitive actions.
- Self-XSS.
- Captcha-related findings.
- Username enumeration on the login, password reset and registration pages.
- OPTIONS/TRACE HTTP method enabled.
- SSL attacks and weaknesses.
- Missing HTTP security headers.
- Results and reports from Static Application Security Tools (SAST).
- Vulnerabilities in third-party applications that are not directly related to the Website.
- Publicly known vulnerabilities.
These findings only become eligible in the event that a reasonable, exploitable attack chain is reported. Please note that, at the discretion of MrD, other findings may also be added to the list of non-qualifying submissions on a case by case basis.
Our Commitment
If you identify a security vulnerability in compliance with this Policy, MrDcommits to:
- acknowledging receipt of your vulnerability report in a timely manner;
- confirming the validity of your report; and
- should your submission be the first for an identified, qualifying vulnerability that was previously not known about at MrD, a certificate of appreciation will be issued to you and attached to your full name.
MrD does not run a bug bounty program, and thus does not offer any monetary rewards for any valid responsible disclosures. MrD will however provide certificates of appreciation for the first instance of an identified vulnerability, as mentioned above.