How to report
Email security@vinclo.ca with "Security" at the start of the subject line. Write in English, and send one report per issue.
We do not publish an encryption key yet. Describe the issue without pasting any personal information or customer data you came across; if we need sensitive details, we will arrange a secure way to receive them. Please do not report through social media or any other public channel.
What to include
- The URL, API endpoint or feature affected.
- What kind of issue it is, and what an attacker could do with it.
- Step-by-step instructions to reproduce it, with any requests, proof-of-concept code or screenshots.
- The account you tested with, and when you tested.
- Any data belonging to someone else that you saw, so we can assess it and tell the people affected.
- Whether and how you would like to be credited.
In scope
- vinclo.ca, this website.
- app.vinclo.ca, the Vinclo product, including its API and the installable mobile app it serves.
- staging.vinclo.ca, our pre-production copy of the product. It holds sample data only.
Vinclo accounts are created by invitation. Test only with an account you own or were given for testing, and only against data that belongs to that account.
Out of scope
- Services run by other companies that Vinclo uses, such as our hosting, email, analytics, payment and accounting providers. Report those to the provider. A flaw in how Vinclo configures or uses them is in scope.
- Denial of service, load or volume testing, and anything else that slows or interrupts the service for other people.
- Social engineering, phishing or physical attempts against Vinclo staff, customers or premises.
- Sending email to any Vinclo address other than the one above, including the addresses customers use to receive mail into Vinclo.
- Findings with no demonstrated impact: a missing header or cookie flag on its own, software version disclosure, clickjacking on a page with no sensitive action, email authentication (SPF, DKIM, DMARC) advice, self-XSS, logout CSRF, and unverified output from automated scanners.
Testing in good faith
- Stop as soon as you reach data that is not yours. Do not view more than you need to show the problem, and do not copy, keep, change or delete it.
- Do not go further than a proof of the problem: no moving to other systems, no lasting access, no downloading data.
- Keep automated scanning slow enough that nobody else notices it.
- Give us time to fix the problem before you talk about it publicly (see Disclosure, below).
- Do not make payment a condition of telling us.
Safe harbour
If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take legal action against you or report you to law enforcement for it, and if someone else takes legal action against you over research that followed this policy, we will make it known that we authorized it.
We can only authorize testing of systems Vinclo runs; we cannot give permission on behalf of other companies. If you are not sure whether something you want to try is covered, ask us first at security@vinclo.ca.
Disclosure
We ask you to keep the details private until we have fixed the problem, or for 90 days from your report, whichever comes first, and to tell us before you publish. If a fix needs longer, we will explain why and agree a date with you.
When a vulnerability affected customer data, we tell the affected customers directly. Vinclo does not run a paid bug bounty, but with your permission we will credit you when we announce the fix.