Found a security issue? Tell us first.
We test other people’s systems for a living, so we take reports about our own seriously. If you believe you have found a vulnerability in a Codatale website or service, here is how to report it and what you can expect from us.
How to report
Email contact@codatale.com with “Security” in the subject line. Please include:
- The affected URL, page or service
- The steps to reproduce the issue
- What an attacker could do with it
- Evidence such as screenshots, requests or a short proof of concept
- Your name or handle, if you would like to be credited
What you can expect from us
- We aim to acknowledge your report within 3 business days.
- We aim to send an initial assessment within 10 business days.
- We will keep you informed until the issue is resolved.
- With your permission, we will credit you once it is fixed.
- We will not share your details with anyone without your consent.
In scope
- codatale.com and its subdomains
- Services and products that Codatale operates under its own name
Out of scope
- Websites and systems we built that are owned and run by our clients. Report those to the client, or to us and we will pass the report on with your permission.
- Third-party services we use, such as hosting, email and social networks
- Denial of service, spam, social engineering and physical attacks
- Reports from automated scanners without a demonstrated impact
- Missing best-practice headers or email settings without a concrete way to exploit them
Rules for good-faith research
- Only test with your own accounts and data.
- Stop as soon as you have confirmed the issue. Do not access, change or delete data that is not yours.
- Do not run denial-of-service tests or high-volume automated scans.
- Do not use social engineering or target our team, clients or offices.
- Give us reasonable time to fix the issue before disclosing it publicly. We ask for 90 days, and we are happy to agree a date together.
Safe harbour
If you follow this policy in good faith, we will consider your research authorised and will not take legal action against you or ask the authorities to investigate you. If a third party takes action against you for research done under this policy, we will make it known that you acted in line with it.
Rewards
We do not run a paid bug bounty. We are grateful for every valid report and, with your permission, we will thank you publicly.
Last updated: