Reporting a vulnerability
Include the URL or endpoint, the steps, and what you were able to access or do.
We acknowledge reports within three business days and will tell you what we intend to do and roughly when.
Safe harbour
If you make a good-faith effort to comply with this policy, we will not pursue legal action against you for your research, and we will say so to anyone who asks.
Good faith means: stop as soon as you have confirmed the issue, do not access or modify anyone else's data beyond what is needed to demonstrate it, do not degrade the service, and give us a reasonable opportunity to fix it before disclosing publicly.
Out of scope
- Denial of service, load testing, or anything that degrades availability
- Social engineering of our staff, our customers, or our providers
- Physical attacks against offices or personnel
- Reports produced solely by an automated scanner, with no demonstrated impact
- Missing security headers or best practices with no exploitable consequence
What we care about most
Anything that lets one party to a transaction read another party's confidential information. Anything that lets a confidential identifier be read back. Anything that lets the audit log be altered or a document be substituted after signature.
Those are the failures that would matter to our customers, so they are the ones we most want to hear about.