Security Disclosure Statement
- Home
- Security Disclosure Statement
Security Disclosure Statement
1. Purpose and Scope
This statement explains how to report a suspected security issue affecting the public website of Strategic Management and Support Services Philippines Inc., referred to on this website as SMASS Philippines, Inc. (SMASS). It covers the corporate website and its inquiry function.
It does not establish a testing program for aircraft, airport systems, airline or maintenance-provider systems, client networks, supplier platforms, or other organizations. A mention, link, or illustration on this website does not bring those systems into scope.
2. Website Safeguards and Limits
The website is designed to use encrypted connections, secure form-session checks, input validation, abuse controls, restricted application-file access, and limited error reporting. Safeguards support confidentiality, integrity, and availability, but cannot guarantee that an internet service will always be secure or available.
This statement is not a claim of regulatory certification, accreditation, independent security assurance, or continuous monitoring. It also does not establish a CAAP approval, aircraft airworthiness determination, or permission to perform regulated aviation work.
3. How to Report a Website Security Concern
Email operations@smassph.com with the subject “Website Security Report.” Published technical reporting contacts are also listed in our security.txt. You do not need to use the public inquiry form to report a concern.
- Identify the affected public page or endpoint and when you observed the issue.
- Describe the observed behavior, the expected behavior, and the potential impact.
- Provide minimal steps or a redacted screenshot where this can be done without further unauthorized access.
- Provide a contact method for clarification if you wish to receive a reply.
Do not include live passwords, access tokens, personal records, or confidential aviation information. Do not send exploit attachments or a bulk data sample. If sensitive evidence is necessary, first request an appropriate exchange method. Reports are handled through business communication channels; no immediate response, fixed remediation deadline, or round-the-clock service is promised.
4. Testing Requires Prior Written Authorization
This statement invites reports of concerns you encounter; it does not authorize scanning, penetration testing, exploitation, credential attacks, automated probing, denial-of-service tests, social engineering, physical access, or attempts to defeat security controls. Authorized testing requires a separate written agreement defining scope, methods, timing, and contacts.
Do not access another person’s records, change or delete data, establish persistence, use obtained credentials, or continue testing to demonstrate greater impact. If you encounter non-public information unexpectedly, stop, avoid copying or sharing it, and report the minimum details needed to locate the exposure.
5. Aviation Safety and Operational Incidents
Do not use this website, an inquiry receipt, or a website vulnerability report as a substitute for established aviation safety, aircraft defect, airport security, emergency, or aircraft-on-ground (AOG) procedures. Contact the responsible operator, airport, maintenance organization, contracted service contact, or competent authority through the appropriate operational channel.
Avoid including passenger or crew details, airport access arrangements, maintenance records, or sensitive operational information in a website security report unless a protected channel and authorized recipients have been agreed.
6. Coordination, Confidentiality, and Rewards
Please give SMASS a reasonable opportunity to assess a report and coordinate any necessary correction before publishing details that could expose people or systems. Do not publish personal information, credentials, or confidential business or aviation records. This request does not restrict lawful reporting to authorities or the exercise of legal rights.
There is no public bug bounty or reward program under this statement. It does not offer a payment commitment, permission to test, or a legal safe harbor. Any separately authorized testing arrangement must state its own conditions.
7. Privacy Concerns and Updates
Send requests concerning your personal data to operations@smassph.com. The Privacy Notice explains the relevant rights and request process. Security-report information is used to assess the concern, communicate about it, and maintain an appropriate handling record.
Reporting contacts and this statement may change as website or operational arrangements change. Refer to the current version before starting any discussion of proposed testing.
