Reporting security issues
How to report a vulnerability to us responsibly, what to include and what you can expect from us.
We take reports of vulnerabilities seriously and are glad to work with security researchers. This page describes how to report an issue to us.
In scope
gmjd-consulting.comand all subdomains, such as the dashboard, Teams, the docs and the plans page- the interfaces these pages call in the browser
Out of scope
- Third-party services such as Stripe, Cloudflare, Auth0 or Vercel. Report findings there directly to the provider.
- Social engineering and phishing against our team or our users
- Attacks on availability (DoS) and mass password guessing
- Self-XSS, meaning code someone only runs in their own browser
- Reports from automated scanners without a demonstrated impact
How to report
Write to security@gmjd-consulting.com. Helpful details are:
- a description of the vulnerability,
- the steps to reproduce it,
- the impact, meaning what an attacker could do with it,
- optionally a suggestion for how to fix it.
What you can expect from us
- We confirm that we have received your report.
- We review it and tell you how we assess it.
- We keep you informed until the issue is fixed.
- We agree the timing of any publication with you.
Rules for testing
We take no legal action against researchers who follow these rules:
- You report the issue as described on this page and do not publish it before it is fixed.
- You do not access, change or delete other users' data. If you need a second account for a test, create one yourself.
- You do not impair the availability of the platform.
- You give us reasonable time to fix the issue.
Rewards
We currently do not pay rewards for reported issues.