Report a vulnerability

How to report

1. Use the contact page and choose Security vulnerability.
2. Say what you found and where. Nothing more is needed.
3. Keep the details to yourself until the problem is fixed or 90 days have passed.

Testing in good faith

Surf Studio will not pursue or support legal action against a person who tests within this policy: your own account only, no other person's data read or kept, no denial of service, no social engineering, and a report before any disclosure.

What happens next

Acknowledgement

Within 3 working days.

Status

Every 14 days until the problem is fixed.

Fix target

90 days. After that you may publish. Sooner, by agreement, once the fix is live.

Credit

You are named in the advisory if you wish.

Reward

Surf Studio pays no bounty.

Scope

The hosts of Surf Studio.