Skip to content
Back to Responsible Disclosure

Scope of Vulnerability Reports

Vulnerabilities covered by this Responsible Disclosure Policy include (but are not limited to)

  • Injection vulnerabilities
  • Broken Authentication and Session Management
  • Cross-Site Scripting (XSS)
  • Remote Code Execution
  • Insecure Direct Object Reference
  • Exposure of Sensitive Data
  • Security Misconfiguration
  • Missing Function-Level Access Control
  • Using Components with Known Vulnerabilities
  • Unvalidated Redirects and Forwards
  • Directory/Path Traversal
  • Exposed credentials

Vulnerabilities that fall outside the scope of this Responsible Disclosure Policy include (but are not limited to): 

  • Issues that are unlikely to require user interaction
  • Account enumeration using brute-force attacks
  • Cross-Site Request Forgery
  • Weak password policies and password complexity requirements
  • Missing HTTP security headers that do not result in a vulnerability
  • Clickjacking on Static Websites
  • Reports from automated tools or scans
  • Vulnerabilities affecting users of outdated browsers
  • Presence of the autocomplete attribute on web forms
  • Missing cookie flags on non-sensitive cookies
  • Reports of SSL issues, best practices, or insecure ciphers
  • Incomplete or missing SPF/DMARC/DKIM records
  • Self-exploitation attacks
  • Social Engineering Attacks
  • Test versions of applications
  • Email configuration issues, including SPF, DKIM, and DMARC settings
  • Clickjacking on pages with no sensitive actions
  • Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms that do not involve sensitive actions
  • Attacks that require a man-in-the-middle (MITM) attack or physical access to a user’s device.
  • Previously known vulnerable libraries without a working proof of concept.
  • Comma-Separated Values (CSV) injection without demonstrating a vulnerability.
  • Lack of best practices in SSL/TLS configuration.
  • Any activity that could disrupt our service (DoS).
  • Content spoofing and text injection issues without revealing an attack vector or the ability to modify HTML or CSS
  • Rate limiting or brute-force issues on endpoints that do not require authentication
  • Missing best practices in Content Security Policy.
  • Missing HttpOnly or Secure flags on cookies
  • Best practices for missing emails (invalid, incomplete, or missing SPF/DKIM/DMARC records, etc.)
  • Vulnerabilities affecting only users of outdated or unpatched browsers [Fewer than two stable versions behind the latest released stable version]
  • Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g., stack traces, application or server errors).
  • Tabnabbing
  • Open redirect – unless an additional security impact can be demonstrated