Responsible disclosure

1. How to reach us

Use our contact page and choose Security report as the subject. Include enough detail to reproduce the issue: the URL or endpoint, the steps, and what you saw. A proof of concept is welcome and is not required.

If the finding is sensitive enough that you would rather not put it through a web form, say so in the form without the detail and we will give you a direct channel.

2. What we commit to

• We aim to acknowledge your report promptly.
• We aim to tell you promptly whether we are treating it as a vulnerability.
• We keep you updated while we fix it, and we tell you when it is fixed.
• We name you on this page if you would like to be named, and not otherwise.

3. Safe harbour

If you make a good faith effort to follow this policy, we will treat your research as authorised, we will not pursue or support legal action against you, and we will work with you to understand and fix the issue quickly.

If somebody else takes action against you for research that followed this policy, tell us and we will make it clear that it was authorised.

4. Scope

In scope:

• justappsec.com and its subdomains, including the application.
• justappsec.co.uk and its subdomains.

Out of scope, because they are not ours to authorise:

• The services we build on, including any address on our domains that one of them runs for us. Report those to the provider: identity to Clerk, hosting to Vercel, the database to Neon, payments to Stripe. Tell us as well if it affects our customers.
• Anything belonging to a third party, including our customers' own systems.

5. What we ask you not to do

• Do not access, change or delete data belonging to anybody else. If a proof of concept needs an account, register a second one of your own.
• Do not run denial of service tests, automated scans heavy enough to degrade the service for other people, or social engineering against our staff, our customers or our suppliers.
• Do not publish the details until we have had a reasonable chance to fix it. If we are taking too long, say so and we will agree a date.

6. What we are most interested in

Anything that crosses a boundary between customers. In rough order:

• Reading or writing data belonging to an organisation you are not a member of.
• Reaching assessment content, or the answer to it, without a live assignment.
• Changing your own role, seat, plan or organisation membership.
• Altering an audit log entry or an evidence export, or forging one.
• Anything that lets you act as another user.

7. Rewards

We do not run a paid bug bounty. We name you here if you ask, and we tell you what we did about it.

9. This policy in machine readable form

How to reach us, and the address of this policy, are also published at /.well-known/security.txt, following RFC 9116.