Security

1. Reporting a vulnerability

If you have found a security problem in the SDCS account system, tell us at [email protected]. Say what you found, where, and how to reproduce it; a proof of concept helps. Please write in English.

We aim to acknowledge a report within five working days, to keep you informed while we work on it, and to tell you when it is fixed. These are aims, not commitments.

2. What we ask of you

• Test only against accounts and organizations you own or have the owner's permission to use.
• Stop as soon as you have shown the problem exists. Do not read, change or delete other people's data, and do not keep any you came across; tell us about it and delete your copy.
• Do not degrade the service: no denial-of-service testing, no high-volume automated scanning.
• Do not use social engineering or phishing against our staff, users or suppliers, and do not attempt physical access to any premises.
• Do not make changes that persist, install anything, or move from one system to another.
• Keep what you found confidential, and give us a reasonable time to fix it, before you tell anyone else.
• Do not ask for payment as a condition of telling us what you found.
• Obey the law, and do not take part if you are on a United States sanctions list or live in an embargoed country.

3. What you can expect from us

If you make a good-faith effort to follow this policy, we will treat your research as authorized by us, we will not start legal action against you for it or ask anyone else to, and if a third party takes action against you over it we will make it known that you acted with our permission.

We cannot authorize research against systems that are not ours, and this policy does not excuse breaking the law or harming anyone. It applies only to research that stays within it.

We do not run a paid bug bounty, and reporting a problem does not entitle you to a reward. We are glad to credit you when the fix is public, if you would like that.

4. In scope

The account site at id.sdcsglobal.com, its API, and the sign-in service SDCS products use.

5. Out of scope

• Services run by others — Stripe, Cloudflare, Microsoft and the like. Report those to the company concerned.
• Findings that need physical access to a person's device, a compromised device or browser, or the victim's own help.
• Reports from automated scanners with no demonstrated impact; missing headers or settings with no demonstrated impact; version disclosure; spam; and rate-limit findings that do not get around a security control.
• Any other SDCS product, unless its own page says it is covered.

6. Changes to this policy

We may change or withdraw this policy at any time. The version in force is the one on this page when you do your research.