Federal ID Reporting a vulnerability
How to tell OFIS about a security problem in the Federal ID service, and what to expect in return.
If you have found a security problem in the Federal ID service, the Federal ID sign-in, their sandbox copies or this website, please tell us before you tell anyone else.
Where to write
- security@federal.africa, or identity@federal.africa if the first does not answer within three working days. [YK: security contact]
- The machine-readable version of this page is /.well-known/security.txt, valid until [YK: security.txt expiry].
Tell us what you found, where, how to reproduce it, and what you think the impact is. A proof of concept against the sandbox (sandbox.identity.federal.africa, sandbox-auth.federal.africa) is welcome; the sandbox holds only test identities.
What we ask
- Test against the sandbox, not production, wherever the problem can be shown there.
- Do not read, change or delete data that is not yours; if you reach another person’s data by accident, stop and tell us.
- Do not run denial-of-service tests, spam or social engineering against OFIS staff or members.
- Give us a reasonable time to fix the problem before you publish: we ask for 90 days, less if the fix is quick.
What we promise
- An acknowledgement within three working days and a first assessment within ten.
- We will not take legal action against research done in good faith within these rules.
- We will tell you when the problem is fixed and, if you wish, credit you on this page.
- We run no paid bounty programme at this time.
Scope
In scope: identity.federal.africa, auth.federal.africa, sandbox.identity.federal.africa, sandbox-auth.federal.africa, federal.africa. Out of scope: federalafrica.com and other community sites, which have their own contacts, and third-party services we use.