SECURITY · VULNERABILITY DISCLOSURE
Report a security issue
If you have found a vulnerability in a Respondyr service, we want to hear about it. This page says how to reach us, what makes a report useful, and what we do and do not offer in return.
Email us the details
Send reports to privacy@respondyr.com. A useful report names the affected URL or service, the steps to reproduce what you found, and what an attacker could do with it. Screenshots or request logs help. The machine-readable version of this policy lives at /.well-known/security.txt.
Please include the substance of your finding in the first message. We read every report that describes an actual issue. We do not respond to inquiries that ask about compensation before disclosing anything.
No bounty program, and we say so up front
Respondyr does not run a bug bounty program and does not pay monetary rewards for vulnerability reports. Payment is not available on request, and reports conditioned on payment will not receive a different answer. If you want your finding credited publicly, say so in your report and we will consider it once the issue is resolved.
Good-faith research
We consider research to be in good faith when it stays inside these lines:
-
Do not touch data that is not yours
If you gain access to customer data, stop, report what you found, and do not copy, store, or share it.
-
No destructive or disruptive testing
No denial of service, no data destruction or modification, no spam, and no degrading the service for real users.
-
No social engineering
Do not phish, impersonate, or otherwise target Respondyr staff or customers.
-
Give us time before going public
Report privately first and allow a reasonable window for a fix before any public disclosure.
We will not pursue action against research conducted in good faith within these rules.