Security and responsible disclosure

How to report a problem

Email [email protected] with "Security" in the subject. Please include:

• what the problem is and where you found it (the address or the part of the app)
• the steps to show it, and what an attacker could do with it
• how we can reach you, and whether you would like to be thanked by name

Please do not put other people's personal data, or secrets you came across, in your email. A description of what you could reach is enough.

What you can expect from us

• We confirm we have your report, and keep you told of our progress.
• We fix confirmed problems as quickly as their seriousness calls for, and tell you when they are fixed.
• With your permission, we thank you by name once the fix is out.

We do not run a paid bug bounty at the moment.

What is in scope

The Shipwardly website and app at shipwardly.com: the scanner, reports, share links, the customer area and the emails we send. Our bot's behaviour is in scope too: if it ever does more than How our bot works describes, we want to know.

Out of scope: the services we use, such as Cloudflare, Stripe and Brevo (please report to them directly), denial of service, spam, social engineering, physical attacks, and reports from automated tools without a demonstrated problem.

Please keep to these rules

• Test only against your own account, or accounts you create for testing. Never access, change or delete anyone else's data beyond the minimum needed to show the problem, and stop as soon as you have.
• Do not degrade the service for others: no denial of service, and keep automated testing slow and light.
• Only scan sites you own or are authorised to test, as our acceptable use policy says, even while testing Shipwardly.
• Give us a reasonable time to fix the problem, normally 90 days, before you share any details publicly.

Good faith research

If you research and report a problem in good faith and keep to the rules above, we will not take legal action against you or ask anyone else to, and we will treat your research as authorised. If someone else takes action against you about research that kept to these rules, we will make it clear that it was authorised.

Problems in sites we scanned

A Shipwardly report describes someone else's website. If you found a problem in a site because of a report, please tell that site's owner, not us. Many sites say how to do that in their own security.txt file. If you think our bot misbehaved on your site, email us with your domain.

security.txt

Our contact details for security reports are also published at /.well-known/security.txt, following RFC 9116.