What we commit to
- Acknowledging your report within three business days
- Keeping you updated on progress until it is closed
- Taking no legal action against anyone acting in good faith under this policy
- Crediting the reporter, if they want credit
What we ask of you
- Give us reasonable time to fix the issue before public disclosure
- Do not access, modify or delete other customers' data
- Use your own test account rather than a customer's
- Do not run load or denial-of-service tests against the live environment
- Include steps to reproduce, so we can verify quickly
Out of scope
- Findings from automated scanning alone, with no proof of exploitability
- A missing security header with no demonstrated practical impact
- Social engineering of our staff or our customers
- Library version reports with no actual exploitation path
How to report
Send the details to support@contento.team