Vulnerability disclosure policy

Report a vulnerability

E-mail support@suhep.com with the subject "Security report". Please include:

• what you found and where (URL, request, parameter);
• steps to reproduce and the impact you expect;
• your name or handle if you want to be credited.

We reply within 3 business days, keep you updated and tell you when the issue is fixed.

Safe harbour

If you act in good faith and follow this policy, we will not take legal action against you for your research. Good faith means you:

• only test against your own accounts or test workspaces;
• do not access, change or delete other people's data (stop and report if you reach any);
• do not degrade the service (no denial-of-service, spam or brute-force tests);
• do not use social engineering, phishing or physical attacks;
• give us reasonable time to fix the issue before you share it publicly (90 days by default).

Out of scope

Missing best-practice headers with no real impact, self-XSS, clickjacking on pages without sensitive actions, SPF/DMARC reports for domains we do not send from, reports created by automated scanners without a working proof, and issues in third-party services (please report those to the vendor).

Rewards

We do not run a paid bug bounty today. If you want, we thank reporters by name on this page.

More

See the security whitepaper and the trust overview. Hostao L.L.C, 30 N Gould St, Ste 4000, Sheridan, Wyoming 82801, USA.