Legal
Vulnerability Disclosure Policy
How to report a security issue in Shortspan, what we commit to in return, and the safe-harbour terms that protect good-faith research.
- Effective
- Last updated
- Entity
- Shortspan Technologies
01How to report
Email security@shortspan.dev. If the finding is sensitive, ask for our PGP key in your first message and we will send it before you share details.
What to include
- The affected component - web console, CLI, API, or marketing site - and the version if you know it.
- Clear reproduction steps, ideally with the exact requests involved.
- What an attacker gains: the impact matters more than the CVSS score.
- Any accounts, tokens, or test data you created, so we can clean them up.
- How you would like to be credited, if you would like to be.
02What we commit to
| Stage | Our target |
|---|---|
| Acknowledgement of your report | Within 1 business day |
| Initial triage and severity assessment | Within 3 business days |
| Status update cadence while we work | At least every 7 days |
| Fix for a critical issue | Within 7 days |
| Fix for a high-severity issue | Within 30 days |
| Public disclosure | Coordinated with you, normally within 90 days |
We will tell you honestly if we disagree that something is a vulnerability, and why. We will not quietly close your report.
03Safe harbour
If you make a good-faith effort to comply with this policy during your research, we will consider your activity authorized, will not pursue civil action or refer the matter to law enforcement, and will say so publicly if a third party takes action against you for it.
This authorization does not extend to activity that breaks the law independently, and we cannot grant safe harbour on behalf of a third party whose systems you touch.
04Scope
In scope
- The web application and API at shortspan.dev
- The Shortspan CLI and its release artefacts
- The credential brokering, encryption, and audit logging paths
- Authentication, session management, passkeys, and two-factor flows
- Authorization and tenant isolation between Workspaces
Out of scope
- Denial-of-service, volumetric, or resource-exhaustion testing.
- Social engineering of our staff, customers, or vendors, and physical attacks.
- Findings that require a fully compromised or physically accessed device.
- Reports produced solely by an automated scanner with no demonstrated impact.
- Missing hardening headers, missing SPF/DMARC, or TLS configuration nits with no exploit path.
- Self-XSS, clickjacking on pages with no sensitive action, and rate-limit findings without a concrete attack.
- Vulnerabilities in third-party services - report those to the vendor concerned.
05Rules of engagement
- 01Test only against accounts and Workspaces you own. Create a free account rather than touching a real customer’s data.
- 02Stop as soon as you have demonstrated impact. Do not pivot further, and do not read data beyond the minimum needed to prove the issue.
- 03Never modify, exfiltrate, or destroy data that is not yours.
- 04Do not degrade the Service for other users.
- 05Keep the finding confidential until we have agreed a disclosure date.
- 06Do not demand payment in exchange for withholding a report - that is extortion, not research.
06Recognition
We do not currently run a paid bug bounty. We do maintain a public acknowledgements list, and we credit every reporter who wants credit in the release notes for the fix.
When a bounty programme launches, reporters who have already helped us will be told first.
07When we disclose to you
Where a vulnerability affected customer data, we notify affected customers directly, and within the timeframes set out in our Data Processing Addendum. Where it did not, we describe the issue and the fix in our release notes once patched.
Security advisories are published in our GitHub organization at https://github.com/shortspan.