Reporting a security issue

How to reach us

Email [email protected]. It reaches the engineers who maintain the product, not a support queue.

Please include enough to reproduce it, a URL or endpoint, the steps, and what you were able to access or change. A short proof of concept is worth more than a scanner export. If the issue is being actively exploited, say so in the subject line.

What we commit to

• We acknowledge within 3 business days , a human reply, not an autoresponder.
• We tell you what we found, whether we could reproduce it, our assessment of the severity, and our intended fix.
• We keep you updated until it is resolved, and we tell you when it ships.
• We will credit you in the release notes if you would like us to, and stay quiet if you would not.
• Safe harbour. We will not pursue or support legal action against anyone who reports in good faith under this policy, stays within the scope below, and gives us reasonable time to fix the issue before disclosing it.

We do not currently run a paid bug bounty. We would rather say that plainly than imply one.

Scope

The Workover web application, its API, and our mobile app. Anything that lets one customer reach another customer’s documents, workspaces or credentials is the most serious class of issue we have, and we will treat it that way.

Please stay out of scope on the following, which help nobody and can harm real customers: denial of service and volumetric testing, social engineering of our staff or customers, physical attacks, and any testing against an account you do not own. Automated scanner output with no demonstrated impact is not something we can act on. If you need an account to test with, ask us and we will make you one.

Disclosure

We aim to ship a fix within 90 days and would ask you to hold public disclosure until then, or until the fix is out if that comes sooner. If we are going to miss that, we will tell you why rather than going quiet. If a fix is genuinely beyond us in that window, we will say so and agree a date with you.