Responsible Disclosure Policy

Version 1.0 – 15 May 2019

Responsible Disclosure

We are dedicated to maintaining the security and privacy of the Envizage API and customer data. We welcome security researchers from the community who want to help us improve our products and services.

 

If you discover a security vulnerability, please give us the chance to fix it by emailing us at security@envizage.me. Publicly disclosing a security vulnerability without informing us first puts the rest of the community at risk. When you notify us of a potential problem, we will work with you to make sure we understand the scope and cause of the issue.


Thank you for your work and interest in making the community safer and more secure!

 

When testing the Envizage API for vulnerabilities, only use the https://api.envizage.me service.

Everything else is not in scope and it won’t affect the Envizage infrastructure.

 

We welcome security researchers in finding and reporting vulnerabilities. When doing so, please bear the following rules in mind:

Rules

  1. NEVER attempt to gain access to another user’s account or data.
  2. NEVER attempt to degrade the services.
  3. NEVER impact other users with your testing.
  4. Test only on the api.envizage.me domain.
  5. Do not use fuzzers, scanners, or other automated tools to find vulnerabilities.

The following types of reports/attacks are out of scope. Do not attempt them:

  • Reports about any service not listed under “In-Scope Services,” above
  • DOS attacks
  • Brute force attacks
  • Physical vulnerabilities
  • Social engineering attacks, including but not limited to:
    • phishing
    • email auth (SPF, DKIM, etc.)
    • hyperlink injection in emails
  • CSRF on forms that are available to anonymous users (e.g., signup, login, contact, Intercom)
  • Self-XSS and issues exploitable only through self-XSS
  • Clickjacking and issues only exploitable through clickjacking
  • Functional, UI and UX bugs and spelling mistakes
  • Descriptive error messages (e.g. stack traces, application or server errors)
  • HTTP 404 codes/pages or other HTTP error codes/pages
  • Banner disclosure on common/public services
  • Disclosure of known public files or directories, (e.g. robots.txt)
  • Presence of application or web browser “autocomplete” or “save password” permission
  • User enumeration on login
  • Absence of rate limits