Security policy

How to report

Tell us what you did, what happened, and what you expected. A request, a command or a short script is worth more than a description. If a proof of concept touches data, say so and stop there. Everybody on the security rota reads that mailbox, so a report does not wait on one person.

What we ask

• Do not touch anyone else’s data. This is a platform many teams share. If you find a way across a team boundary, show it with two accounts you control and stop.
• Do not degrade the service: no load testing, no denial of service, no scanning that makes heavy traffic.
• Leave site visitors alone. Published sites can carry contact forms, and what visitors send belongs to them and the site’s owner.
• Stop at proof. Once you can show the problem exists, that is enough.

In scope

The hosted platform: the API, the dashboard, the Git gateway, builds and publishing, previews and the sites it hosts. The Webentor packages a site is built with are in scope too.

We are most interested in crossing a team boundary, escaping a build, reading or writing another team’s repository through the Git gateway, getting past sign-in or the second confirmation that irreversible actions ask for, and anything that reaches a stored credential.

Out of scope

• Scanner output with no demonstrated impact.
• Missing hardening headers on responses that carry nothing sensitive.
• Social engineering, physical access, or attacks that need a compromised developer machine.
• Problems in services we depend on. Report those to the service, and tell us so we can mitigate.

What happens next

• We acknowledge your report within 2 working days.
• We tell you whether we reproduced it within 7 working days.
• We agree a disclosure date with you when the fix is ready, not after.
• We fix a critical finding within 30 days, or tell you why not and what we are doing in the meantime.

We keep you informed while it is fixed. If you would like credit, tell us the name to use; if you would rather not be named, that is fine too.

Safe harbour

If you follow this policy, we will not pursue or support legal action against you for your research, and we will say so in writing if anybody else raises it. We consider research done in good faith under this policy authorised, we will not report you to law enforcement or ask anyone else to, and if a third party acts against you for it, we will make our authorisation clear to them.

This does not cover taking other people’s data, degrading the service for others, or social engineering our staff or suppliers. If you hit something ambiguous, ask us first: we would rather answer a question than argue about a boundary afterwards.