Security / Disclose a vulnerability
Found a hole?
Tell us first.
If you found a security problem in one of our systems, we want to hear about it, and we will not take action against good-faith research that follows the rules below.
01 In scope
segfaultsec.org and its subdomains, including the client dashboard and the API.
02 Please do
- Use test accounts you own, and stop once you can show the problem.
- Give us a reasonable time to fix it before you tell anyone else.
- Send enough detail to reproduce it: the steps, the URL, what you expected and what happened.
03 Please do not
- Access, change or delete data that is not yours, or keep more of it than you need to prove the problem.
- Run denial-of-service tests, spam, or social engineering against our staff or clients.
- Test our clients' own systems. They are not in scope here.
04 What happens next
You get a reference number right away. A security engineer reads every report, tells you whether we can reproduce it, and keeps you updated until it is fixed. If you ask for it, we credit you publicly once it is fixed.
Send a report
Prefer email? Write to security@segfaultsec.org.