Introduction

At Skribble, we are committed to ensuring the privacy and security of our customers’ data. We recognise and appreciate security researchers who help us keep our customers safe by reporting security vulnerabilities in our systems and services.

This policy is intended to provide security researchers who wish to conduct security testing against our systems with clear guidelines on how to identify and report vulnerabilities to us.

Please note that this is not a Bug Bounty program. We do not usually grant monetary rewards for reported vulnerabilities, although exceptions for particularly critical vulnerabilities may be made entirely at Skribble’s discretion.

Table of contents

Authorisation

Security research is considered as authorised if you:

• Conduct your activities in good faith, with the intent of reporting them to us.
• Notify us as soon as possible after discovering a security issue.
• Make reasonable effort to avoid user privacy violations.
• Immediately cease your activities upon inadvertently accessing sensitive data, notify us of your findings and immediately delete the information from your systems.
• Only exploit the identified issues to the necessary extent to confirm its presence and produce a proof of concept to demonstrate the attack.
• Provide us with a reasonable amount of time to investigate, validate and mitigate the issue before publicly disclosing any information about it.

Security research will not be considered as authorised if you:

• Exploit security issues for any reason rather than testing purposes.
• Intentionally access other user’s account or data without their explicit consent.
• Intentionally conduct disruptive attacks that could affect systems availability or lead to the destruction of data.
• Attempt to demand payment or engage in extortion before disclosing security findings to us.

The following attacks are explicitly forbidden: