Scope
This policy covers:
- the website at cynorida.com, including every page and file it serves;
- any other service Cynorida operates under the
cynorida.comdomain or its subdomains.
If you are not sure whether a system belongs to us or falls within this policy, email security@cynorida.com and ask before you test it.
Out of scope
The following are not covered by this policy and are not authorised:
- third-party services, including the providers we use and systems that belong to our clients, even when they link to or from our domain. Report those to their owners;
- denial-of-service testing, or anything that degrades the availability of a service;
- social engineering of anyone who works for us or with us, or of our clients, including phishing and phone pretexting;
- physical attacks against our premises, people or equipment;
- sending spam or unsolicited messages through any of our channels;
- volumetric or automated scanning that generates a high volume of requests;
- findings that require an already compromised device, account or browser to exploit.
How to report
Email your report to security@cynorida.com. Please report each vulnerability separately, unless several issues have to be chained together to have an impact.
Our contact details are also published in machine-readable form at /.well-known/security.txt.
What to include
A good report lets us reproduce the issue without coming back to you with questions. Please include:
- the affected URL, service or component;
- the type of vulnerability and what an attacker could do with it;
- step-by-step instructions to reproduce it, with any proof-of-concept code, requests or screenshots;
- the date and time of your testing, and the IP addresses you tested from;
- how you would like to be credited, if at all, and how we can reach you.
Do not include personal data, credentials or other sensitive information you came across. Describe it instead.
What we commit to
When you report a vulnerability to us in line with this policy, we will:
- acknowledge your report within 3 business days;
- triage it and send you an initial assessment within 10 business days of receiving it;
- keep you updated as we investigate and fix the issue;
- agree the timing of any public disclosure with you, so that it happens once a fix is available or at a date we have both accepted;
- credit you, under the name or handle you choose, in any public acknowledgement of the issue, if you want to be credited.
Safe harbour
If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue legal action against you for that research, and we will not ask anyone else to.
This authorisation covers only systems within the scope of this policy. We cannot authorise testing of systems that belong to someone else.
If you are unsure whether something you plan to do is consistent with this policy, ask us first at security@cynorida.com.
Rules for researchers
To stay within this policy, you must:
- not access, change or delete data beyond the minimum needed to show that the vulnerability exists;
- stop testing and report to us straight away if you access personal data or data that belongs to someone else, and not keep, copy or share it;
- avoid any action that could harm our services, our clients or other users;
- give us reasonable time to fix the issue before you disclose anything publicly;
- never demand payment or any other benefit in exchange for not disclosing, or for handing over, a vulnerability. We treat that as extortion, and it falls outside this policy.
No bug bounty
Cynorida does not run a bug bounty programme and does not pay for vulnerability reports. We are grateful for every report, and we will credit you if you would like us to.
Preferred languages
Please write your report in English.
Changes to this policy
We may update this policy from time to time. The version on this page is the one that applies, and the date at the top shows when it last changed. Its permanent address is https://cynorida.com/security/disclosure.