Security
Coordinated vulnerability disclosure policy
Contents5 sections
Email security@buckrr.com. You do not need to encrypt the report, and you do not need an account.
Useful in a report: what the problem is, which version of Buckrr you saw it on, and how to reproduce it. A rough description is better than no report. Send what you have.
We acknowledge every report within 72 hours. If we have not replied in that time, assume the mail went astray and send it again.
We tell you whether we think it is a real problem, and roughly when we expect a fix. If we disagree that it is a vulnerability, we say so and explain why.
When a fix ships we credit you by name, unless you would rather we did not.
Give us reasonable time to fix the problem before you publish. Ninety days is the usual figure and we will not argue about it. If a problem is already being exploited, tell us that first, because it changes what we are obliged to do.
Do not access, modify or delete data belonging to other people while investigating. Do not run denial of service tests against our systems.
In scope: the Buckrr desktop application, the licensing API at api.buckrr.com, and buckrr.com itself.
Out of scope: findings against third party services we happen to use, reports generated by an automated scanner with no demonstrated impact, and missing hardening headers with no exploit behind them.
Buckrr is a one-person business and there is no money in this. We say so plainly rather than letting you find out after the work.