Responsible Disclosure Policy

We welcome reports from security researchers and anyone else who finds a vulnerability in BrandedMark. If you think you've found a security issue, please tell us so we can fix it.

#How to report

Email [email protected] with:

• what the vulnerability is and where it is (the URL, endpoint or component);
• the steps to reproduce it, and a proof of concept if you have one;
• the impact you think it has; and
• how to contact you, if you want us to.

Please don't include any personal data you may have come across beyond what is strictly necessary to show the issue.

#What we'll do

• Acknowledge your report within 5 business days.
• Keep you updated while we investigate, and tell you when the issue is fixed.
• Credit you publicly if you'd like us to, once the fix is in place.
• We don't run a paid bug bounty.

#Scope

In scope:

• www.brandedmark.com;
• the BrandedMark app and public API we operate on brandedmark.com and its subdomains;
• customer portals on *.brandedmark.app; and
• the BrandedMark CLI.

Out of scope:

• Customers' own custom domains, except for vulnerabilities in the BrandedMark platform serving them.
• Third-party services and providers we use. Report those to the vendor.
• Denial-of-service or volumetric testing.
• Social engineering or phishing of our staff or customers.
• Physical attacks.
• Spam.
• Reports from automated scanners with no demonstrated impact.
• Missing security headers or cookie flags with no demonstrated exploit.
• Clickjacking on pages with no sensitive actions.
• Self-XSS.
• Rate-limit issues on non-sensitive endpoints.
• Outdated software versions without a working exploit.

#Rules of engagement

When testing, please:

• only use accounts you own, or test tenants you've created;
• never access, change or delete data belonging to anyone else, and stop and tell us straight away if you do come across it;
• not degrade the service for other users;
• not use automated scanning at a volume that affects the service;
• give us a reasonable amount of time to fix the issue (we aim for 90 days) before you disclose it publicly, and coordinate the disclosure with us; and
• comply with the law.

#Safe harbour

If you follow this policy in good faith, we will:

• treat your research as authorised;
• not take legal action against you or report you to law enforcement for it; and
• work with you to understand and fix the issue.

If a third party takes legal action against you for activity that complied with this policy, we'll make it known that your actions were authorised.

This doesn't give you permission to act in a way that is inconsistent with the law or that would cause us to breach our legal obligations.

#security.txt

Our machine-readable security contact is published in security.txt, in line with RFC 9116.

#Version history