Vulnerability disclosure policy
We welcome reports from security researchers. If you believe you have found a vulnerability in Absenca, please tell us, following this policy.
Scope
In scope: absenca.com, app.absenca.com, api.absenca.com, and Absenca's apps for Slack, Microsoft Teams and Google Chat.
- Out of scope: services run by other companies, such as our hosting provider, Stripe, Slack, Microsoft and Google. Please report to them directly.
- Out of scope: denial of service, spam, social engineering and physical attacks.
- Out of scope: reports from automated scanners, and missing best-practice settings, without a demonstrated security impact.
How to report
Email security@absenca.com with a description of the issue, the steps to reproduce it, its impact, and how we can reach you. English is preferred.
Rules for testing
- Test only with accounts and organizations you created yourself.
- Do not access, change or delete other people's data. If you reach any by accident, stop, do not keep it, and tell us.
- Do not run denial-of-service or high-volume automated tests.
- Keep the issue confidential until we have fixed it, or for 90 days after your report, whichever comes first, unless we agree otherwise.
Safe harbour
If you act in good faith and follow this policy, we consider your research authorised, and we will not take legal action against you or ask anyone else to. If a third party takes action against you over research that followed this policy, we will make it known that you acted within it.
What you can expect from us
- An acknowledgement within 3 business days.
- An initial assessment within 10 business days.
- A fix as fast as we can: we aim for 30 days for critical issues and 90 days for others, and we keep you updated.
- Public thanks, if you would like it, once the issue is fixed.
No bounty
We do not run a paid bug bounty programme and cannot pay for reports.