Responsible Disclosure Policy
How to report a security vulnerability in Everdeck, and what we promise in return.
Draft for review. This policy is a draft pending review by a Singapore-qualified lawyer. It is not final and may change before Everdeck launches.
FLOW FN PTE. LTD. (UEN 202617303Z) welcomes reports from people who find security vulnerabilities in Everdeck. If you follow this policy, we will work with you to understand and fix the issue, and we will not take legal action against you.
How to report
Email [email protected] with "Security" in the subject line. Please include:
- what you found and where (the address, page or API involved);
- the steps to reproduce it, and any proof-of-concept code;
- the impact you believe it has;
- how we can contact you, and whether you'd like to be credited.
Our contact details are also published at /.well-known/security.txt.
In scope
- The Everdeck website and web application on our production domain, and their APIs.
- Weaknesses that let someone see or change another customer's data, bypass approvals or limits, take over an account, read credentials, or make our servers reach networks they shouldn't.
Out of scope
- Services run by others, including our subprocessors and the apps customers connect. Report those to their owners.
- Social engineering, phishing, or physical attacks against our staff, offices or customers.
- Denial-of-service attacks or tests that degrade the service.
- Reports from automated scanners without a demonstrated impact.
- Missing security headers or cookie flags without a working exploit; self-XSS; clickjacking on pages without sensitive actions; rate limits on pages that don't need them.
Rules for testing
- Use only accounts you created, and test only against your own data.
- Don't access, change or delete other people's data. If you reach any by accident, stop, don't keep a copy, and tell us.
- Don't run tests that could disrupt the service for others, and keep automated requests to a gentle rate.
- Don't use what you find for anything other than confirming and reporting the issue.
- Give us reasonable time to fix the issue before telling anyone else: 90 days, or sooner once a fix is released, unless we agree otherwise.
Our promises
- We acknowledge your report within three business days.
- We keep you informed while we investigate and fix the issue.
- We credit you publicly once it's fixed, if you'd like us to.
- If you follow this policy in good faith, we consider your research authorised, we will not pursue legal action against you, and if someone else does over research done under this policy, we will make clear that it was authorised.
We don't run a paid bug bounty at present.