Vulnerability disclosure policy
How to report a vulnerability in the platform, what is in scope, our response targets, and the safe harbour for researchers who act in good faith.
1. How to report
Send the report through the contact form with the topic set to security, or to the contact address published in our security.txt at the well-known path. Include the affected URL or endpoint, the steps to reproduce, the impact you observed and, if you have one, a proof of concept. Do not include other people’s personal data in the report; if you encountered some, say so and stop.
2. Scope
- In scope: the platform and its API, and production deployments on the canonical domain.
- Out of scope: third-party services we integrate with (report those to the provider), social engineering of our staff, physical attacks, and denial-of-service or volumetric testing against production.
- Testing against customer applications through the platform is governed by the Terms of Service and the ownership-proof rules, not by this policy.
3. Our response targets
| Severity | First response | Then |
|---|---|---|
| Critical | Within 24 hours | A fix or mitigation as the first priority; you are told when it is deployed |
| High | Within 72 hours | A fix scheduled and dated; you are told when it is deployed |
| Medium and low | Within seven days | Triage, a decision, and a date if a fix is planned |
4. Safe harbour
We will not pursue legal action against researchers who act in good faith, follow this policy, avoid privacy violations and service disruption, do not access or modify data that is not their own beyond what is needed to demonstrate the issue, and give us reasonable time to remediate before public disclosure. If a law we are subject to requires us to report an incident to a regulator, we will do so without naming a good-faith researcher as an attacker.
5. Coordinated disclosure and credit
We ask for a reasonable period to fix the issue before it is published, and we tell you when the fix is deployed. If you would like to be credited, we name you in the fix note. We do not run a paid bug bounty programme and we say so rather than imply one.
Related documents
Questions about this document go to the contact form with the topic set to legal; a reply comes from a person within one business day.