Vulnerability Disclosure Policy

Last updated: 25 October 2026 (version 1.1).

1. Purpose

GlobeID Limited ("GlobeID") operates the PassportScan platform, which processes identity data of hotel guests on behalf of accommodation providers. We value the work of security researchers and want to hear about any vulnerability that could put that data, our customers or our users at risk.

This policy explains how to report a security vulnerability to us, what you can expect from us, and the rules that apply while testing. It supports GlobeID's information security management system (ISO/IEC 27001:2022 controls A.5.7 Threat intelligence and A.8.8 Management of technical vulnerabilities).

2. Scope

In scope

• The PassportScan Cloud web applications and APIs published at app.passportscan.net, api.passportscan.net, workspace.passportscan.net, distributor.passportscan.net and selfcheckin.passportscan.net
• The PassportScan mobile applications published by GlobeID on the Apple App Store and Google Play
• The PassportScan self check-in web flow used by guests
• The public website https://www.passportscan.net

Out of scope

• Systems operated by third parties (cloud provider consoles, payment provider, identity provider, property-management systems integrated by customers)
• VPN infrastructure (including vpn.passportscan.net) and any internal-only hostnames under passportscan.net not listed as in scope
• Customer-owned devices, networks and on-premise installations
• Social engineering, phishing or physical attacks against GlobeID staff, contractors or customers
• Denial-of-service or resource-exhaustion testing of any kind
• Automated scanning that generates high volumes of traffic (our edge rate-limits and blocks abusive sources)
• Findings that only affect outdated browsers or require a compromised device
• Reports about missing best-practice headers, SPF/DMARC configuration or version disclosure without a demonstrated impact

3. How to report

Send your report to security@passportscan.net. Please include:

• a description of the vulnerability and the component affected (URL, app version, endpoint)
• step-by-step instructions to reproduce it, with requests/responses or screenshots where useful
• your assessment of the impact
• how we can contact you for follow-up (anonymous reports are accepted)

If the report contains personal data of guests or customers, send only the minimum needed to demonstrate the issue and delete any copy once we confirm receipt.

A machine-readable pointer to this policy is published at https://www.passportscan.net/.well-known/security.txt (RFC 9116).

4. What you can expect from us

Where a vulnerability results in, or is likely to result in, a personal data breach, GlobeID follows its Incident Response & Data Breach Procedure, including notification of affected customers (controllers) without undue delay and of the supervisory authority within 72 hours where required by GDPR Art. 33.

5. Rules of engagement (safe harbour)

We will not pursue legal action, and will not report you to law enforcement, for security research that complies with this policy. In return we ask you to:

• act in good faith and avoid privacy violations, data destruction, and service disruption
• stop testing and report immediately as soon as you encounter personal data (identity documents, guest records) — do not download, store or share it
• use only accounts you own or are explicitly authorised to use; do not attempt to access other customers' data
• not exploit a vulnerability beyond what is needed to demonstrate it (no pivoting, persistence or lateral movement)
• not perform denial-of-service, brute-force or spam testing
• keep the details of the vulnerability confidential until we have remediated it and agreed on disclosure

GlobeID's production environment is monitored (web application firewall, request logging and alerting). Testing that breaches these rules may be blocked automatically and treated as an attack.

6. Coordinated disclosure

We ask for a 90-day window from acknowledgement before any public disclosure, extendable by mutual agreement where a fix requires coordination with a third party (for example a mobile app store release or a customer integration). We are happy to credit researchers in our release notes on request.

7. Recognition

GlobeID does not currently run a paid bug-bounty programme. We acknowledge valid reports publicly (with your consent) and may, at our discretion, offer a token of appreciation for high-impact findings.

8. Our own vulnerability management

Independently of external reports, GlobeID:

• scans every container image for known vulnerabilities when it is pushed to the image registry, and reviews third-party dependencies as part of the release process
• applies a risk-based patching policy with the remediation targets in section 4
• commissions periodic independent penetration testing of the platform
• tracks all findings in its vulnerability register, reviewed by the Information Security Officer

9. Contact

Security reports: security@passportscan.net Privacy matters: privacy@passportscan.net Legal entity: GlobeID Limited, The Black Church, St. Mary's Place, Dublin 7, D07 P4AX, Ireland (CRO 559612)