1. How to report
Email security@stipulex.com in English. Encrypt your report with our PGP key; the fingerprint and key are at the top of this page. Include:
- The type of vulnerability
- The affected URL
- How to reproduce it
- Any special configuration needed to reproduce it
- The impact, and what an attacker could do with it
Follow-up details are welcome on the same thread.
2. What we commit to
- We acknowledge your report within 5 business days.
- We keep you updated on our progress until the issue is resolved.
- With your permission, we credit you on our security hall of fame.
3. Scope
In scope
- www.stipulex.com
Out of scope
- app.stipulex.com until it launches
- dcs.stipulex.com
- Third-party services we use
- Physical security of our Redwood City office
- Social engineering of our staff
Not sure whether something is in scope? Ask us at security@stipulex.com before you test it.
4. Rules of engagement
Do
- Test only what you need to prove the issue.
- Stop and report as soon as you have proof.
- Keep the issue confidential until we have fixed it.
- Delete any data you obtained once you have reported it.
Don’t
- Run denial of service attacks.
- Run destructive or high-volume automated scans.
- Brute-force logins, codes or tokens.
- Install malware or leave persistent code.
- Access, copy, download, change or delete data that isn’t yours, including contract or sample data, beyond the minimum needed to show the issue.
- Go back in after you have proof, move to other systems, or share your access.
- Phish, vish, spam or otherwise socially engineer anyone.
- Attack our office or equipment physically.
- Do anything that degrades the availability, performance, confidentiality or integrity of our systems or data.
5. Low-impact findings
We read every report, but these usually aren’t treated as valid unless you can show a real impact:
- Missing security headers or cookie flags
- Clickjacking on pages with no sensitive action
- SPF, DKIM or DMARC configuration
- Software version or banner disclosure
- Self-XSS
- Output from automated scanners without a working proof
6. Disclosure
We practice coordinated disclosure. Please wait 90 days from your report, or until a fix ships if that is sooner, before you publish. Tell us before you publish so we can coordinate.
7. Safe harbor
Follow this policy and you’re covered.
We treat good-faith security research under this policy as authorized. We won’t pursue or support legal action against you for it. If a third party takes action against you over research that followed this policy, we will tell them you acted under it.
This policy is governed by California law.
8. Recognition
We don’t pay bounties. With your permission, we list you on our security hall of fame. Stipulex employees, contractors and interns, current or former, are not eligible for listing.
9. Changes to this policy
We may update this policy. The version on this page is the one that applies, and the date at the top shows when it last changed.